Cybersecurity researchers have identified a malicious supply chain campaign targeting OpenAI Codex developers through a compromised npm package and Android applications that exfiltrate sensitive authentication tokens to attackers.

Key Points

• The malicious npm package "codexui-android" has recorded over 29,000 weekly downloads and embeds code to steal local Codex authentication tokens.
• Stolen data includes access, refresh, and ID tokens, which are sent to a malicious server masquerading as the monitoring platform Sentry.
• Two Android applications, "OpenClaw Codex Claude AI Agent" and "Codex," have been identified as part of the campaign, totaling over 60,000 downloads.
• The attacker, linked to the npm account "friuns" and developer "BrutalStrike," uses a PRoot sandbox to extract credentials from the ~/.codex/auth.json file.
• Researchers warn that stolen refresh tokens provide attackers with persistent, indefinite access to a user's account and associated capabilities.

Why it Matters

This campaign highlights a growing trend of threat actors targeting AI developer tools to gain unauthorized access to sensitive cloud environments and user data. Because the stolen refresh tokens do not expire, victims face long-term security risks that persist even after initial detection.