{"schema_version":"0.10.0","id":"LR-2026-0553","record_version":1,"title":"Malicious codexui-android npm package exfiltrates OpenAI Codex auth tokens","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.24,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Hackread · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Hackread · subject to change"}]},"sources_hash":"db031ce270ebd3ac7228c41be4a1e3f17fbd7f6d0d5d4634e87810edde9db10a"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Remote web user interface for OpenAI Codex","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-05-27","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"A remote web user interface for OpenAI Codex, the npm package codexui-android, was published with code that is absent from its GitHub repository. The published builds ran at module load, read the local Codex auth.json file and sent its full contents to an external server, sentry.anyclaw[.]store, whose name was chosen to resemble Sentry telemetry. Security firm Aikido Security found the code and shared its research with Hackread, which reported it on 31 May 2026. The package had about 27,000 weekly downloads, and the same author's Android apps installed the npm build on launch. After Aikido contacted the author, a comment claiming loss of npm account access was posted and then deleted, and a statement that did not address the findings replaced it. As of 31 May 2026 the package and apps remained online.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.aikido.dev/blog/codex-remote-ui-steals-ai-tokens","publisher":"Aikido Security","date":"2026-05-27","type":"press","title":"Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens - Aikido Security","archived_url":null,"attachment":"first_report"},{"url":"https://hackread.com/codex-ui-tool-secretly-stole-openai-refresh-tokens/","publisher":"Hackread","date":"2026-05-31","type":"press","title":"27,000-Download Codex UI Tool Secretly Stole OpenAI Refresh Tokens - Hackread","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.intended_use":"C","event.date_disclosed":"C","event.detection_method":"C","event.incident_class":"C","impact.severity":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":0,"quote":"codexui-android is a remote web UI for OpenAI Codex."}],"event.date_disclosed":[{"source_index":1,"quote":"On 27 May 2026, Aikido Security shared research with Hackread.com about a malicious npm package called codexui-android."}],"event.detection_method":[{"source_index":1,"quote":"Aikido Security’s researcher, Charlie Eriksen, discovered that this package ran a supply chain attack last month to steal user data."}],"event.incident_class":[{"source_index":1,"quote":"Aikido Security’s researcher, Charlie Eriksen, discovered that this package ran a supply chain attack last month to steal user data."}],"impact.severity":[{"source_index":1,"quote":"A popular software tool used by thousands of mobile developers has been found stealing authentication tokens."}],"event.summary":[{"source_index":0,"quote":"codexui-android is a remote web UI for OpenAI Codex."},{"source_index":0,"quote":"The endpoint is named sentry.anyclaw[.]store to blend with the package's legitimate Sentry error-reporting traffic."},{"source_index":0,"quote":"The exfil code was never committed to GitHub either."},{"source_index":1,"quote":"On 27 May 2026, Aikido Security shared research with Hackread.com about a malicious npm package called codexui-android."},{"source_index":1,"quote":"They deleted it shortly after, replacing it with a corporate statement denying any credential theft."},{"source_index":1,"quote":"As of today, the malicious software package and the apps are still live online."}]},"notes_on_gaps":"Sources are press only (Aikido Security blog and Hackread); no statement from npm, Google, OpenAI or the package author's verified account is quoted. No exact date of occurrence or first detection is stated; 'about a month ago' and 'last month' are relative and were not converted. Developer identity of the malicious package is not confirmed beyond press naming the author as BrutalStrike; adversary type (external or insider) is not stated, so adversarial_actor is unknown. No trigger in the closed list is stated, so trigger is omitted. No failure_class is set because no autonomous agent was involved. Severity 'major' is my judgement from the stated 'thousands of mobile developers' and the ongoing exfiltration on every run; the sources give no bounded scope. No count of records or affected parties, no direct loss, and no time to contain are stated. The control G3 outcome 'failed' is my mapping of the stated failure of a source audit and of the Play pre-publish scan; no remediation was reported and the package was still live at reporting. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Hackread · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The package was a working remote web UI for OpenAI Codex, used by developers.","quote":"codexui-android is a remote web UI for OpenAI Codex.","source_index":0,"grade":"C"},{"step":"caught","text":"Aikido Security researchers found the code and shared their research with the press.","quote":"On 27 May 2026, Aikido Security shared research with Hackread.com about a malicious npm package called codexui-android.","source_index":1,"grade":"C"},{"step":"done","text":"At the time of reporting, the package and the apps were still available online.","quote":"As of today, the malicious software package and the apps are still live online.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.aikido.dev/blog/codex-remote-ui-steals-ai-tokens","https://hackread.com/codex-ui-tool-secretly-stole-openai-refresh-tokens/"]},"analysis":{"sections":{"timeline":[{"text":"The exfiltration has been in place since version 0.1.82 of the package.","quote":"The exfiltration has been in place since codexui-android@0.1.82.","source_index":0,"when":null},{"text":"Aikido Security shared its research on the package with Hackread.","quote":"On 27 May 2026, Aikido Security shared research with Hackread.com about a malicious npm package called codexui-android.","source_index":1,"when":"2026-05-27"},{"text":"At the time of the Hackread report, the package and apps were still live.","quote":"As of today, the malicious software package and the apps are still live online.","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.aikido.dev/blog/codex-remote-ui-steals-ai-tokens","https://hackread.com/codex-ui-tool-secretly-stole-openai-refresh-tokens/"]}}