cyber.hendryadrian.com
Security News · thehackernews.com

Malicious npm Package and Android Apps Found Stealing OpenAI Codex Tokens

· Original article ↗

Summary

Researchers say the codexui-android npm package and two BrutalStrike-linked Android apps stole Codex tokens and sent them to sentry[.]anyclaw[.]store. Separately, Google elevated a finding about delayed API-key revocation to a P0 bug.

Key points

  • Researchers found codexui-android extracting access, refresh and ID tokens from ~/.codex/auth.json and sending them to sentry[.]anyclaw[.]store.
  • The package is presented as a remote web UI for OpenAI Codex and had more than 29,000 weekly downloads.
  • Aikido researchers found the same token-theft chain in two Android apps linked to BrutalStrike, with reported downloads exceeding 50,000 and 10,000.
  • The package author said they were investigating and removing affected functionality, and claimed no credential data was shared with third parties.
  • Researchers reported deleted Google API keys can remain usable for up to 23 minutes; Google subsequently treated the issue as a P0 bug.
  • Researchers said the delayed revocation window could allow access to data and APIs, including Google Gemini, while credentials appear revoked.

Article Details

Event Type
Malicious npm supply-chain package and Android apps stealing OpenAI Codex credentials
Impact
Researchers reported that codexui-android and two Android apps linked to BrutalStrike exfiltrated Codex authentication tokens. A stolen refresh token could allow persistent account impersonation, but the article does not report a confirmed number of compromised accounts. The npm package had over 29,000 weekly downloads; the Android apps had over 50,000 and 10,000 downloads. Separately, researchers found deleted Google API keys could remain usable for up to 23 minutes, with a median revocation window of about 16 minutes, potentially exposing Gemini-related data. Google subsequently classified that issue as a P0 bug.

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainThe malicious code was embedded in an npm package distributed to developers as a software supply-chain attack.T1552.001 · Credentials In FilesThe package read Codex authentication tokens from the local ~/.codex/auth.json file.

People

Charlie EriksenAikido Security researcher who described the token exfiltration and the Android app delivery chain.Joe LeonResearcher quoted describing the exposure risk from delayed revocation of deleted Google API keys.

Vendors

GoogleThe same exfiltration chain was also found in Android apps linked to BrutalStrike, while a separate finding showed deleted Google API keys can remain usable long enough to expose data through Google Gemini.OpenAIResearchers uncovered a malicious supply chain campaign hiding in the npm package codexui-android, which secretly steals OpenAI Codex authentication tokens from developers and sends them to sentry.anyclaw[.]store.

Products

CodexResearchers uncovered a malicious supply chain campaign hiding in the npm package codexui-android, which secretly steals OpenAI Codex authentication tokens from developers and sends them to sentry.anyclaw[.]store.codexui-androidResearchers uncovered a malicious supply chain campaign hiding in the npm package codexui-android, which secretly steals OpenAI Codex authentication tokens from developers and sends them to sentry.anyclaw[.]store.Google GeminiThe same exfiltration chain was also found in Android apps linked to BrutalStrike, while a separate finding showed deleted Google API keys can remain usable long enough to expose data through Google Gemini.OpenAI CodexResearchers uncovered a malicious supply chain campaign hiding in the npm package codexui-android, which secretly steals OpenAI Codex authentication tokens from developers and sends them to sentry.anyclaw[.]store.OpenClaw Codex Claude AI AgentAikido said it observed an Android application named OpenClaw Codex Claude AI Agent (package name: “gptos.intelligence.assistant”) that runs the npm package within its PRoot sandbox and sends the Codex credentials to

Related Articles