A popular npm package for OpenAI Codex, codexui-android, has been stealing developer tokens for approximately one month. The package had around 29,000 weekly downloads and featured an active GitHub repository, appearing legitimate.
12 storiesAI & TechnologyOpenAI developments & fundingAI coding tools (GitHub Copilot, Cursor)
OpenAI Codex tool with 29,000 weekly downloads stole developer tokens
IN SHORT
A popular npm package for OpenAI Codex, codexui-android, has been stealing developer tokens for approximately one month. The package had around 29,000 weekly downloads and featured an active GitHub repository, appearing legitimate.
1 / 2
FREQUENTLY ASKED
codexui-android is an npm package that was advertised as a remote web UI for OpenAI Codex. It has been found to contain malicious code that steals developer tokens.
The package had approximately 29,000 weekly downloads, suggesting a significant number of developers may have been exposed.
The malicious activity of stealing developer tokens has been ongoing for approximately one month.