The recent discovery of a malicious supply chain campaign targeting developers using OpenAI Codex through a legitimate-looking remote web UI has raised significant concerns in the cybersecurity community. The tool, named codexui-android, is advertised on GitHub and npm as a remote web UI for OpenAI Codex, attracting over 29,000 weekly downloads. What makes this activity noteworthy is that it's not a traditional attack that uses a typosquat or throwaway package to trick developers. Instead, the malicious code is embedded into a functional npm package that has undergone active development. The associated GitHub repository remains clean.
The nefarious changes were introduced about a month after the package was published to the registry, likely in an effort to build user trust and expand its reach. The npm account associated with the package is 'friuns' (aka Igor Levochkin). The package contains code that extracts the contents of Codex's '~/.codex/auth.json' file and exfiltrates them to a remote server ('sentry.anyclaw[.]store') that masquerades as Sentry, a legitimate application monitoring and error tracking platform. The captured data includes accesstoken, refreshtoken, id_token, and account ID.
The refreshtoken doesn't expire, and an attacker holding it can silently impersonate the user indefinitely. A stolen Codex refreshtoken goes beyond access to a chat interface; it's persistent, silent access to whatever that account can do. Every time a user logs in to the Codex app, CLI, or IDE Extension using either ChatGPT or an API key, the login details are cached locally in a plaintext file at '~/.codex/auth.json' or in the operating system-specific credential store. OpenAI warns users to treat this file like a password and not to commit it, paste it into tickets, or share it in chat.
The threat actor also uses an Android application named OpenClaw Codex Claude AI Agent that runs the npm package within its PRoot sandbox and sends the Codex credentials to the same endpoint. The APK itself is small (26 MB) and looks clean on a Play pre-publish scan. On first run, it extracts a Termux-derived Linux userland into the app's private storage and runs Node.js inside it via PRoot. The version is not pinned, so the device pulls whatever is currently published on npm. The exfiltration has been in place since codexui-android@0.1.82.
The same exfiltration chain has also been flagged in a second Android app linked to BrutalStrike: Codex (package name: 'codex.app'), which has been downloaded over 10,000 times. The remaining three apps offered by the developer do not contain the functionality. The author of the npm package initially posted a comment stating they had lost access to their npm account, only to edit the response and claim they are 'currently investigating this issue internally' and that they 'have started removing the affected functionality and related data'. However, the author has not provided a clear explanation for why this code was inserted only into the npm package build or why they needed access to the Codex tokens in the first place.
The domain 'anyclaw[.]store' was registered on April 12, 2026, just two days after the very first version of the npm package (version 0.1.72) was uploaded to npmjs[.]com. This development comes as threat actors are increasingly targeting real artificial intelligence (AI) developer tooling and workflows to steal credentials and burrow deeper into the software supply chain. The findings highlight how credential revocation delays are exploitable and can be used to gain unauthorized access to cloud environments, while defenders assume the credentials have been revoked.
This incident underscores the importance of vigilance and proactive security measures in the face of evolving cyber threats. As AI continues to play a pivotal role in software development, developers must remain vigilant and take steps to protect their credentials and data. Organizations should also prioritize the security of their software supply chain and implement robust security practices to mitigate the risk of supply chain attacks.
