OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack
A malicious npm package and Android apps are stealing OpenAI Codex auth tokens from developers and sending them to attacker-controlled infrastructure.
Intelligence analysis by GPT-5.4 Mini
Researchers say a seemingly legitimate npm package, codexui-android, and related Android apps quietly pull Codex auth data from local files and exfiltrate it to a fake Sentry domain. The campaign targets developers using Codex through web, CLI, and IDE logins.
A fake helper tool was hiding inside a real-looking software package. When people signed into Codex, the tool quietly copied the secret login notes from the computer.
Those notes are like a house key that keeps working. If a thief gets them, the thief may keep getting back in even after the owner thinks the lock was changed.
The trick was spread through both a software package and some Android apps, so the same bad code could reach more people. It was like putting a spy camera inside a toolbox that lots of builders trust.
Analysis
What happened
Cybersecurity researchers at Aikido say a malicious supply-chain campaign is targeting developers who use OpenAI Codex. The package at the center of it, codexui-android, is presented on GitHub and npm as a remote web UI for Codex and has drawn more than 29,000 weekly downloads. The unusual part is that the package is functional and under active development, while the GitHub repository stays clean. The malicious behavior was reportedly added about a month after the package first appeared, which may have helped it build trust before the theft started.
What it steals
According to the report, the package reads Codex credentials from ~/.codex/auth.json and sends them to a remote server at sentry.anyclaw[.]store, which is designed to look like Sentry. The copied data includes access_token, refresh_token, id_token, and account ID. OpenAI’s own support docs warn that the file can contain access tokens and should be treated like a password.
The article stresses that the refresh token is the most dangerous piece because it does not expire. That means an attacker who gets it can keep acting as the victim without obvious interruption.
Broader distribution
Aikido also says the same exfiltration chain shows up in an Android app called OpenClaw Codex Claude AI Agent, published by an entity named BrutalStrike, with more than 50,000 downloads. A second app linked to the same publisher, codex.app, reportedly uses the same path and has more than 10,000 downloads. The package version used by the app is not pinned, so the device pulls whatever is currently on npm.
The author’s response was also muddy: they first said they had lost access to the npm account, then changed the message to say they were investigating and removing the affected code. The article says that does not explain why the tokens were needed in the first place.
Key points
- Researchers say `codexui-android` embedded token theft into an otherwise working npm package.
- The code reportedly exfiltrates Codex auth data from `~/.codex/auth.json` to a server posing as Sentry.
- Aikido says the same behavior appears in Android apps that run the npm package inside a sandbox.
- The article says the stolen refresh token can allow long-lived, silent account impersonation.
- OpenAI warns that file-based Codex auth storage should be treated like a password.
The article shows the abuse path clearly enough that developers and defenders can look for the package, the Android apps, and the fake endpoint. OpenAI’s warning about treating `auth.json` like a password gives users a concrete handling rule to reduce exposure.
The package was still available for download, and the report says the Android apps had already reached tens of thousands of installs. Because the refresh token does not expire, anyone who already leaked it could keep access for a long time without immediate signs of failure.
