Cases › security breach › LR-2026-0553

Malicious codexui-android npm package exfiltrates OpenAI Codex auth tokens

Preliminary Why: 1 report: Hackread · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: action reported, no fix

Severity major

Reported 27 May 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

A remote web user interface for OpenAI Codex, the npm package codexui-android, was published with code that is absent from its GitHub repository. The published builds ran at module load, read the local Codex auth.json file and sent its full contents to an external server, sentry.anyclaw[.]store, whose name was chosen to resemble Sentry telemetry. Security firm Aikido Security found the code and shared its research with Hackread, which reported it on 31 May 2026. The package had about 27,000 weekly downloads, and the same author's Android apps installed the npm build on launch. After Aikido contacted the author, a comment claiming loss of npm account access was posted and then deleted, and a statement that did not address the findings replaced it. As of 31 May 2026 the package and apps remained online.

What happened

1 · What it was doingThe package was a working remote web UI for OpenAI Codex, used by developers.

2 · How it was caughtAikido Security researchers found the code and shared their research with the press.

What was done

At the time of reporting, the package and the apps were still available online.

Risks

Supply-chain compromise
Primary24 incidents
Rising: 4 vs 0.2 a week

AI system attacked or breached
Also23 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Sandboxed code execution

Application

Signed and verified components · Vetting of plug-ins, skills and dependencies · AI bill of materials · Vulnerability scanning of AI components · Model provenance checks · Least-privilege access for the agent

Infrastructure / target

Secrets scanning

Evidence

No source states: what went wrong, what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 2 items from the primary sources

What happened, in order

2026-05-27 Aikido Security shared its research on the package with Hackread.

Not dated in the sources:

At the time of the Hackread report, the package and apps were still live.

Show every field, with its source and grade

The AI system

What it was for

Remote web user interface for OpenAI Codex

C one secondary source states it

What happened

Earliest source we hold

2026-05-27

C one secondary source states it

Who caught it

an outside party

C one secondary source states it

What went wrong

security breach

C one secondary source states it

Impact

Severity

major

D inferred by us from the described behaviour, reason shown

Notes on gaps

Sources are press only (Aikido Security blog and Hackread); no statement from npm, Google, OpenAI or the package author's verified account is quoted.

LR-2026-0553 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON