{"schema_version":"0.10.0","id":"LR-2026-0541","record_version":1,"title":"OpenAI Codex authentication tokens stolen via malicious npm package codexui-android","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":61.4,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.8,"unhedged_language":4.44},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":3,"reports_independent":1,"reports_derivative":1,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"30fe887c132913aa8f54599107bb76b52fd690f52b8e2fbf80f357ba85df4078"},"system":{"model_name":null,"model_version":null,"developer":"OpenAI","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-01","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"A malicious npm package named codexui-android, advertised as a remote web UI for OpenAI Codex and attracting over 29,000 weekly downloads, was used to collect Codex authentication tokens. The associated GitHub repository remained clean, and the malicious code was reportedly introduced into the published npm package about a month after it was first published. When a developer ran the tool, it looked for Codex authentication tokens and sent them to an attacker-controlled server. The stolen tokens included a refresh token that does not expire. Aikido Security researchers found and disclosed the activity, and two related Android apps were also linked to the same exfiltration chain. The package author said the affected functionality and related data were being removed.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"Malicious code was present in the published npm package but not in the public GitHub source code.","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Author stated the affected functionality and related data were being removed.","precursor_events":null,"primary_risk":"RK06","secondary_risks":["RK03","RK04"],"control_chain":[{"layer":"L3","party":"deployer","party_name":null,"control_id":"H3","outcome":"missing","reason":null,"quote":"It's worth mentioning here that every time a user logs in to the Codex app, CLI, or IDE Extension using either ChatGPT or an API key, the login details are cached locally in a plaintext file at ~/.codex/auth.json or in the operating system-specific credential store.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate test: data of others touched with a bounded scope stated; the source states over 29,000 weekly downloads of the affected package and no unbounded scope.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":["authentication tokens","account ID"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/06/openai-codex-authentication-tokens.html","publisher":"The Hacker News","date":"2026-06-01","type":"press","title":"OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.techradar.com/pro/security/openai-codex-tool-with-over-29-000-downloads-linked-to-malicious-npm-supply-chain-attack-stealing-authentication-tokens","publisher":"TechRadar","date":"2026-06-01","type":"press","title":"OpenAI Codex tool with over 29,000 downloads linked to malicious npm supply chain attack stealing authentication tokens - TechRadar","archived_url":null,"independence":"derivative"},{"url":"https://www.csoonline.com/article/4179815/attack-targeting-openai-codex-users-exposes-ai-software-supply-chain-risks.html","publisher":"CSO Online","date":"2026-06-02","type":"press","title":"Attack targeting OpenAI Codex users exposes AI software supply chain risks - CSO Online","archived_url":null}],"per_field_confidence":{"system.developer":"C","event.incident_class":"C","event.detection_method":"C","event.adversarial_actor":"C","event.root_cause_detail":"C","event.remediation":"C","impact.data_categories_exposed":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":1,"quote":"Codex is OpenAI’s coding assistant and software engineering agent that can write and review code, fix bugs, run tests, and help developers build software with nothing but plain language input."}],"event.incident_class":[{"source_index":2,"quote":"A malicious npm package posing as a remote user interface for OpenAI Codex exfiltrated developer authentication tokens, after attackers allegedly published code to npm that was not visible in the project’s public GitHub repository."}],"event.detection_method":[{"source_index":2,"quote":"Researchers at Aikido said the package, called codexui-android, appeared to offer legitimate functionality while collecting authentication tokens and sending them to an external server."}],"event.adversarial_actor":[{"source_index":2,"quote":"A malicious npm package posing as a remote user interface for OpenAI Codex exfiltrated developer authentication tokens, after attackers allegedly published code to npm that was not visible in the project’s public GitHub repository."}],"event.root_cause_detail":[{"source_index":2,"quote":"Yet the malicious code that stole sensitive tokens only appeared in the published version, not in the public source code."}],"event.remediation":[{"source_index":0,"quote":"Upon reaching out to the package author on GitHub, Aikido said they initially posted a comment stating they had lost access to their npm account, only to edit the response and post a different one in which they claimed they are \"currently investigating this issue internally\" and that they \"have started removing the affected functionality and related data.\""}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The captured data includes the following details: access_token, refresh_token, id_token, and account ID."}],"impact.severity":[{"source_index":0,"quote":"The tool, named codexui-android, is advertised on GitHub and npm as a remote web UI for OpenAI Codex, attracting over 29,000 weekly downloads."}],"impact.severity_because":[{"source_index":0,"quote":"The tool, named codexui-android, is advertised on GitHub and npm as a remote web UI for OpenAI Codex, attracting over 29,000 weekly downloads."}],"event.control_chain":[{"source_index":0,"quote":"It's worth mentioning here that every time a user logs in to the Codex app, CLI, or IDE Extension using either ChatGPT or an API key, the login details are cached locally in a plaintext file at ~/.codex/auth.json or in the operating system-specific credential store."}],"event.summary":[{"source_index":0,"quote":"The tool, named codexui-android, is advertised on GitHub and npm as a remote web UI for OpenAI Codex, attracting over 29,000 weekly downloads."},{"source_index":0,"quote":"The associated GitHub repository remains clean."},{"source_index":0,"quote":"The nefarious changes are said to have been introduced about a month after the package was published to the registry, likely in an effort to build user trust and expand its reach."},{"source_index":1,"quote":"When a developer runs the tool, it looks for their Codex authentication tokens and exfiltrates them to an attacker-controlled server."},{"source_index":2,"quote":"Aikido said the package stole access tokens, refresh tokens, ID tokens, and account IDs, with the refresh token posing particular risk because it does not expire."},{"source_index":1,"quote":"The implications are rather dangerous, explained Aikido Security researcher Charlie Eriksen, who found and disclosed the attack."},{"source_index":1,"quote":"Aikido also said it saw two Android apps, both published by the same account, who were also targeting Codex users."},{"source_index":0,"quote":"Upon reaching out to the package author on GitHub, Aikido said they initially posted a comment stating they had lost access to their npm account, only to edit the response and post a different one in which they claimed they are \"currently investigating this issue internally\" and that they \"have started removing the affected functionality and related data.\""}]},"notes_on_gaps":"Not stated: the date the malicious code was first published or the exact date exfiltration began (only relative timing given); the exact count of affected users (download counts are not affected counts); any data-volume or account-count figures; the Codex model version; whether any autonomous agent acted (agent_involved, autonomy and failure_class were left out because the sources describe credential theft from users, not agent behaviour); the attacker's identity beyond the npm account name, which is unverified; and whether the author's removal was completed. Judgements made: root_cause set to integration because the malicious code was in the published package build; responsible_party and adversarial_actor set to third_party and external_attacker from the description of attackers; severity set to moderate on the stated bounded download scope; harm classes chosen from the credential exfiltration. Source 2 gives around 27,000 weekly downloads while Sources 0 and 1 give over 29,000; both figures are reported as stated. Controls were limited to those the sources tie to this incident. The Google API key and AWS key revocation findings in Source 0 concern other incidents and were excluded. No remediation is recorded as a fix with controls added, because the author's stated removal is not shown to add any listed control. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The system was OpenAI Codex, a coding assistant and software engineering agent, and the malicious package was offered as a remote web UI for it.","quote":"Codex is OpenAI’s coding assistant and software engineering agent that can write and review code, fix bugs, run tests, and help developers build software with nothing but plain language input.","source_index":1,"grade":"C"},{"step":"went_wrong","text":"About a month after release, an npm update added information-stealing code to the tool.","quote":"However, approximately a month into its existence, the tool received an update on npm which added information-stealing code.","source_index":1,"grade":"C"},{"step":"reached","text":"The code read the Codex auth file and sent its contents to a remote server disguised as a legitimate monitoring service.","quote":"Present within the package is code that extracts the contents of Codex's \"~/.codex/auth.json\" file and exfiltrates them to a remote server (\"sentry.anyclaw[.]store\") that masquerades as Sentry, a legitimate application monitoring and error tracking platform.","source_index":0,"grade":"C"},{"step":"caught","text":"Aikido Security researchers found and disclosed the attack.","quote":"The implications are rather dangerous, explained Aikido Security researcher Charlie Eriksen, who found and disclosed the attack.","source_index":1,"grade":"C"},{"step":"done","text":"The package author said the affected functionality and related data were being removed.","quote":"Upon reaching out to the package author on GitHub, Aikido said they initially posted a comment stating they had lost access to their npm account, only to edit the response and post a different one in which they claimed they are \"currently investigating this issue internally\" and that they \"have started removing the affected functionality and related data.\"","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/06/openai-codex-authentication-tokens.html","https://www.techradar.com/pro/security/openai-codex-tool-with-over-29-000-downloads-linked-to-malicious-npm-supply-chain-attack-stealing-authentication-tokens","https://www.csoonline.com/article/4179815/attack-targeting-openai-codex-users-exposes-ai-software-supply-chain-risks.html"]},"analysis":{"sections":{"timeline":[{"text":"Domain sentry.anyclaw[.]store registered; the first version (0.1.72) of the npm package had been uploaded two days earlier.","quote":"WHOIS records indicate that the domain was registered on April 12, 2026, just two days after the very first version of the npm package (version 0.1.72) was uploaded to npmjs[.]com.","source_index":0,"when":"2026-04-12"},{"text":"Malicious code introduced into the npm package about a month after it was first published.","quote":"The nefarious changes are said to have been introduced about a month after the package was published to the registry, likely in an effort to build user trust and expand its reach.","source_index":0,"when":null},{"text":"Exfiltration in place from version 0.1.82 onward.","quote":"The exfiltration has been in place since codexui-android@0.1.82.","source_index":0,"when":null},{"text":"Package author stated the affected functionality and related data were being removed.","quote":"Upon reaching out to the package author on GitHub, Aikido said they initially posted a comment stating they had lost access to their npm account, only to edit the response and post a different one in which they claimed they are \"currently investigating this issue internally\" and that they \"have started removing the affected functionality and related data.\"","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/06/openai-codex-authentication-tokens.html","https://www.techradar.com/pro/security/openai-codex-tool-with-over-29-000-downloads-linked-to-malicious-npm-supply-chain-attack-stealing-authentication-tokens","https://www.csoonline.com/article/4179815/attack-targeting-openai-codex-users-exposes-ai-software-supply-chain-risks.html"]}}