codexui-android npm Malware Stole OpenAI Codex Tokens

What happened

A popular npm package called codexui-android, marketed as a remote web interface for OpenAI's Codex coding agent, was quietly harvesting developers' Codex credentials. Security firm Aikido Security uncovered the behavior and shared its findings with several outlets. The package read the local file ~/.codex/auth.json and sent its full contents to an attacker-controlled server 2. That file holds the access token, refresh token, ID token and account ID 14.

The exfiltration endpoint, sentry.anyclaw[.]store, was dressed up to look like Sentry, the widely used error-monitoring service 12. That disguise matters, because outbound traffic to something that resembles a telemetry provider is exactly the kind of noise developers and network monitors tend to ignore.

The theft also reached beyond npm. Two Android apps from a publisher called "BrutalStrike" reportedly delivered the same payload, with install counts of more than 50,000 and more than 10,000 1. That puts the operation on mobile as well as developer workstations.

How the attack worked

The most instructive detail is where the malicious code lived. The package was polished and fully functional. Aikido found the theft logic only in the published npm artifact, not in the public GitHub repository 34. Anyone who reviewed the source on GitHub would have seen nothing wrong 3.

The first line of dist-cli/index.js imports a hidden file, chunk-PUR7OUAG.js. It runs as soon as the module loads, with no function call or condition required 34. It checks for local Codex credentials and, if it finds them, sends them off 4. A comment left in the source map reportedly said the tokens would be sent "always," whatever else the tool was doing 3. That rules out an accidental debugging leftover. Hackread's analysis suggests the author likely built a genuine user base before weaponizing the package 4.

The refresh token is the real prize. Coverage stresses that the stolen refresh tokens do not expire, so an attacker can keep impersonating a victim until the token is manually revoked 12.

Where the accounts diverge

The reporting agrees on the mechanics but differs on several numbers and dates:

• Download counts: Some outlets cite about 29,000 weekly downloads 12. Hackread puts it at roughly 27,000 4. CSO Online gives a range spanning both 5.
• Disclosure date: One account dates Aikido's disclosure to June 1, 2026 1. Others say the research was shared on May 27, 2026 24.
• Duration: Estimates of how long the theft ran range from about a month 2 to roughly two months 1.
• Remediation status: The Cyber Signal reported the package was still live on npm at the time of writing 2. CSO Online described the exfiltration as happening "before OpenAI patched it" 5.

The remediation point is the one that matters most to readers. Any patch on OpenAI's side would not undo already-stolen non-expiring refresh tokens. Developers should not assume a vendor fix has closed their exposure.

Why it matters

This is a familiar supply-chain pattern aimed at a newer target. AI coding agents hold credentials that act like API keys, often with broad account access. As one analysis puts it, AI dev credentials are "the new API key," yet many developers protect them far less carefully 1.

CSO Online places the incident in a wider cluster of Codex-related security concerns. It cites a critical command-injection flaw, CVE-2025-61260, rated CVSS 9.8, which allowed silent remote code execution through malicious project-local MCP configurations 5. It also notes OpenAI's own warning that connecting ChatGPT's developer-mode MCP support to untrusted servers risks prompt-injection-driven data theft and destructive write actions 5. CSO's argument is that enterprise adoption of agentic coding tools is outpacing the tools needed to vet MCP servers, permissions and the growing set of tokens these agents hold 5.

That argument holds up. The codexui-android case shows that reviewing source on GitHub is not enough when the published package can differ from it. Verifying what was actually installed, ideally through reproducible builds or provenance attestations, matters more than reading the repository.

What to do now

Organizations whose developers installed codexui-android should treat their Codex credentials as compromised 2. Recommended steps:

1. Revoke Codex tokens through OpenAI's platform 1.
2. Force-rotate the affected credentials 2.
3. Audit npm install logs across developer machines to find exposure 2.
4. Check whether the BrutalStrike Android apps are present on any devices 1.

The broader lesson is that credentials for AI coding agents now deserve the same protection as cloud keys.