OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack
codexui-android npm package stole OpenAI Codex authentication tokens from developers.
A malicious supply chain attack targeted developers using OpenAI Codex through a compromised npm package named codexui-android. The package, with over 29,000 weekly downloads, exfiltrated Codex authentication tokens to an attacker-controlled server. The same exfiltration chain was found in two Android apps.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenAI?
Get an email when a new story names OpenAI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA compromised npm package named codexui-android infiltrated the software supply chain, stealing OpenAI Codex authentication tokens from over 29,000 weekly users. The malicious package exfiltrated sensitive credentials to attacker-controlled servers, demonstrating how supply chain attacks can compromise developer tools and steal valuable API access tokens. This incident highlights the critical need for package verification, dependency monitoring, and secure token management in development environments.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — sentry.anyclaw[.]store
- malware — codexui-android
- malware — OpenClaw Codex Claude AI Agent