Case codexui-android-npmAI supply chainWorldwide
Trojanized codexui-android npm package steals OpenAI Codex tokens
A package posing as a remote web UI for OpenAI Codex built a user base for a month before activating a payload that exfiltrated Codex authentication tokens.
MediumAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 2, 2026
- Location
- Worldwide
- Target
- OpenAI Codex users
- Severity
- Medium
- Triggered by
- Package author of codexui-android (identity not public)
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
A package posing as a remote web UI for OpenAI Codex built a user base for a month before activating a payload that exfiltrated Codex authentication tokens.
Impact: Codex access, refresh and ID tokens of an unknown number of developers (package had ~27,000 weekly downloads) exfiltrated, enabling persistent account access
Who triggered it
Actor: Package author of codexui-android (identity not public)
Attribution: Discovered by Aikido Security; author claimed lost npm access then said it was investigating; no law-enforcement attribution
Motive: Theft of OpenAI Codex refresh tokens for persistent account access
How it happened
Attack vector: Working Codex web UI package that fetched malicious code at runtime, read ~/.codex/auth.json, XOR-encoded it and POSTed it to a fake Sentry endpoint at sentry.anyclaw.store
Root cause: Codex stored non-expiring refresh tokens in a plaintext file readable by any installed package, and npm package contents diverged from the public GitHub source
Timeline
- Package gains roughly 27,000-29,000 weekly downloads; exfiltration runs for about a month
- Aikido Security publicly discloses the token stealer
- Companion Android apps found forwarding Codex credentials to the same endpoint
Response
Malicious code removed by author after inquiry; researchers advised revoking and rotating Codex tokens and blocking the exfiltration domain
Current status: Contained
Sources (open in a new tab)
- Cloud Security Alliance labs.cloudsecurityalliance.org
- Kiteworks kiteworks.com
- PointGuard AI pointguardai.com
Cite this case
Trojanized codexui-android npm package steals OpenAI Codex tokens. AI Threat Watch, case codexui-android-npm, Jun 2, 2026. https://aithreat.io/cases/codexui-android-npm/
Permanent link: https://aithreat.io/cases/codexui-android-npm/