# OpenAI Codex Credentials Stolen in Wide-Scale npm Supply Chain Attack


A legitimate-looking npm package with 29,000 weekly downloads has been quietly exfiltrating authentication tokens from developers for the past month. The same threat actor is operating Android apps that target the same victims.


A significant supply chain attack is underway against developers using OpenAI Codex, with malicious code embedded in a widely-downloaded npm package and coordinated Android applications stealing OAuth refresh tokens that never expire, according to security researchers at Aikido Security.


The attack represents a sophisticated deviation from typical supply chain compromises. Rather than using typosquatting or throwaway packages to deceive developers, the threat actor embedded malicious code into codexui-android, a functional and actively-maintained npm package that has earned developer trust over time. The package, which claims to provide a remote web UI for OpenAI Codex, accumulates over 29,000 downloads per week and remains available on the npm registry.


## The Threat: Persistent Credential Compromise


The vulnerability lies in what the package does after gaining access to a user's system. Once installed, codexui-android extracts the contents of ~/.codex/auth.json—a plaintext file containing OpenAI Codex authentication credentials—and sends it to an attacker-controlled server masquerading as Sentry, a legitimate application monitoring platform (sentry.anyclaw[.]store).


The stolen data includes:

  • access_token — Immediate access to the Codex service
  • refresh_token — Persistent access that never expires
  • id_token — Additional OAuth credential
  • account ID — Full account identification

    • The most critical aspect of this theft is the refresh token. As Aikido Security researcher Charlie Eriksen explained, "The refresh_token doesn't expire. An attacker holding it can silently impersonate you indefinitely. A stolen Codex refresh_token goes beyond access to a chat interface—it's persistent, silent access to whatever that account can do."


    This means an attacker with the refresh token can maintain unauthorized access to a developer's Codex account indefinitely, potentially accessing sensitive code, generating malicious code, or leveraging the account for further attacks without detection.


    ## Background and Context: How the Attack Evolved


    The malicious modifications to codexui-android were introduced approximately one month after the package's initial publication—a deliberate strategy to build user trust and maximize its distribution before activating the payload. The npm account associated with the package is registered under the username "friuns," identified as Igor Levochkin.


    The timing is significant. Early versions of the package remained clean, allowing it to accumulate downloads and establish a reputation as a legitimate tool. Once a sufficient user base was achieved, the malicious code was injected. This approach is far more effective than releasing a compromised package immediately, as it bypasses initial security scrutiny and developer skepticism.


    "Every single invocation has been quietly exfiltrating your Codex authentication tokens to an attacker-controlled server," Eriksen said of the compromised versions.


    OpenAI's own documentation warns developers about the sensitivity of these credentials, stating: "If you use file-based storage, treat ~/.codex/auth.json like a password: it contains access tokens. Don't commit it, paste it into tickets, or share it in chat." The attacker leveraged the fact that most developers store these tokens locally in plaintext, unencrypted and often forgotten about after installation.


    ## Multiple Attack Vectors: Android Apps Amplify the Campaign


    The threat doesn't stop at the npm package. Aikido researchers uncovered a coordinated set of Android applications that download and execute the malicious npm package within a sandboxed environment, extending the attack to mobile users.


    OpenClaw Codex Claude AI Agent (package name: gptos.intelligence.assistant) has been downloaded over 50,000 times. The application appears benign in pre-publish scans—it's only 26 MB and looks clean on first inspection. However, on first run, it extracts a Termux-derived Linux userland into the app's private storage and runs Node.js inside via PRoot (a user-space implementation of chroot/mount).


    The app then pulls the latest version of codexui-android from npm—and critically, the npm package version is not pinned, meaning the app automatically downloads whatever version is currently published. When a user signs in to Codex within the app, the malicious package intercepts the auth.json file and exfiltrates it to the same attacker server.


    A second Android app, Codex (package name: codex.app), linked to an entity calling itself "BrutalStrike," exhibits the same exfiltration behavior and has been downloaded over 10,000 times. Three additional apps from the same developer do not contain the malicious functionality, suggesting a selective or evolving campaign.


    ## Technical Details: The Exfiltration Chain


    The attack chain unfolds in layers:


    1. Installation phase: Developer installs codexui-android via npm or runs the Android app

    2. Credential capture: On Codex login, credentials are written to ~/.codex/auth.json (plaintext)

    3. File extraction: Malicious code reads the auth.json file

    4. Exfiltration: Credentials are transmitted to sentry.anyclaw[.]store/startlog

    5. Persistence: The attacker now holds a non-expiring refresh token and can impersonate the developer indefinitely


    The use of a server disguised as Sentry—a legitimate and trusted monitoring platform—is a social engineering touch designed to evade detection if credentials are logged or discovered in network analysis.


    ## Implications for Developers and Organizations


    This attack affects a broad population: anyone who has installed the codexui-android npm package or used the Android applications since the malicious code was introduced. The 29,000 weekly downloads suggest significant exposure.


    The implications extend beyond individual developer accounts:


  • Organizational risk: Developers using Codex within enterprise environments may have compromised their organizations' access to code generation tools
  • Code integrity: Attackers could generate malicious code suggestions or manipulate outputs
  • Lateral movement: Compromised Codex accounts could be pivots for broader organizational attacks
  • Compliance violations: Stolen credentials may constitute data breaches under regulatory frameworks like GDPR or HIPAA

    • The attack also highlights a broader vulnerability in the npm ecosystem: the lack of robust supply chain security controls that can prevent legitimate-looking packages from introducing malicious code over time.


    ## Recommendations for Defense


    Immediate actions for affected developers:


  • Revoke credentials: If you've installed codexui-android or used the Android apps, immediately reset your OpenAI Codex credentials and authentication tokens
  • Audit activity: Check OpenAI Codex logs (if available) for unauthorized access or suspicious activity
  • Uninstall packages: Remove codexui-android from all development environments
  • Update systems: Ensure you're running the latest patched versions of legitimate tools

    • For organizations:


  • Inventory audit: Identify developers using OpenAI Codex and npm packages in general
  • Supply chain monitoring: Implement automated detection of suspicious package behavior using tools that analyze package behavior changes over time
  • Token rotation: Establish regular credential rotation policies for API keys and OAuth tokens
  • Network monitoring: Monitor outbound connections to unexpected domains, particularly those masquerading as legitimate services

    • For the broader developer community:


  • Avoid plaintext credential storage: Use operating system credential managers instead of plaintext files where possible
  • Verify package authenticity: Check package metadata, star history, and contributor reputation before installation
  • Monitor package updates: Use tools that alert you when installed packages receive updates, and review changelogs before upgrading
  • Implement least privilege: Run development tools with minimal required permissions

    • ---


    ## HackWire Analysis


    This attack is deceptive in its simplicity and devastating in its execution. Unlike headline-grabbing breaches that involve zero-day exploits or sophisticated technical intrusions, this campaign succeeds through patience, trust-building, and the exploitation of developer complacency around local credential storage.


    The most troubling element is the refresh token. Unlike access tokens that may have short lifespans, refresh tokens are designed for persistence—they're the attacker's golden ticket to indefinite impersonation. OpenAI's own documentation warns developers to treat auth.json "like a password," yet storing tokens in plaintext remains industry-standard practice because alternatives (OS credential stores) vary across platforms and development workflows.


    The Android apps deserve particular attention. They represent a novel attack pattern: using legitimate-looking mobile apps to execute malicious npm packages in a sandboxed environment. This hybrid approach—mobile delivery, Node.js execution, npm package exploitation—shows sophisticated understanding of the developer toolchain. The choice of PRoot and Termux suggests the threat actor has deep knowledge of how developers work across platforms.


    The numbers matter: 29,000 weekly downloads on npm, 50,000+ downloads for the primary Android app. Even if only a fraction represent unique victims who actually logged in and had tokens exfiltrated, we're looking at thousands of potentially compromised OpenAI Codex accounts—each representing organizational risk, intellectual property exposure, and downstream security liability.


    The attacker's response when contacted—initially claiming lost account access, then claiming to investigate internally—suggests either a compromised account or an attempt to buy time. Either way, it indicates the threat actor is monitoring security disclosures closely.


    This incident is a reminder that supply chain security isn't just about large, dramatic breaches. The most effective attacks are often the quiet ones: embedded in tools developers trust, exfiltrating credentials developers forget about, operating under the radar until the damage compounds. — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Tools](https://www.hackwire.news/category/tools) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)