OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack
A supply chain attack targeting OpenAI Codex developers has been discovered through a malicious npm package named ‘codexui-android’. The package, developed by ‘friuns’ (Igor Levochkin) and promoted by ‘BrutalStrike’, silently exfiltrated authentication tokens, including refresh tokens, from developers’ local storage, allowing attackers persistent access to their Codex accounts. This attack highlights the growing risk of compromised developer tools and the importance of secure credential management within AI development workflows.
The attack centers around the ‘codexui-android’ npm package, which presented itself as a remote web UI for OpenAI Codex. Despite attracting over 29,000 weekly downloads, the package contained malicious code that extracted and exfiltrated developers’ Codex authentication tokens. The threat actor, identified as ‘friuns’ (Igor Levochkin) and operating under the ‘BrutalStrike’ entity, embedded this functionality into a seemingly legitimate package, building trust and expanding its reach. The exfiltration process involved reading the `~/.codex/auth.json` file, containing access tokens, refresh tokens, and account IDs, and sending them to a server masquerading as Sentry, located at ‘sentry.anyclaw[.]store’.
Adding to the complexity, the attacker also deployed two additional Android applications, ‘OpenClaw Codex Claude AI Agent’ and ‘Codex (codex.app)’, both leveraging the same malicious npm package within a PRoot sandbox. These apps, downloaded over 50,000 and 10,000 times respectively, further amplified the attack surface. The attacker’s initial response to the discovery was misleading, claiming lost access to their npm account and initially denying any credential sharing, despite the clear evidence of token exfiltration. The timing of the package’s initial release, just two days after version 0.1.72, and the subsequent activity by ‘BrutalStrike’ underscores a deliberate and coordinated effort to compromise Codex developers.