An npm package stole OpenAI Codex tokens for a month, and the token never expires
There is a particular kind of security story that should make you check your own machine before you finish reading it. This is one of those. A package on npm called codexui-android, advertised as a remote web UI for OpenAI Codex, pulled in more than 29,000 weekly downloads. For roughly the last month, every single install ran code that copied your Codex authentication tokens off your disk and shipped them to a server pretending to be Sentry. The package was still live and still downloadable when researchers went public.
I want to walk through what actually happened, because the interesting part is not the malicious package itself. Malicious npm packages are a weekly event now. The interesting part is the credential it stole, and why that credential is worse to lose than your password.
What the package did
The disclosure came from Aikido Security, where researcher Charlie Eriksen traced the behavior down to a single file read. Codex stores your login state in ~/.codex/auth.json. That file holds an access token, a refresh token, an id token and your account id, in plain text, because it has to be readable by the tool every time it runs. codexui-android read that file on every invocation and sent its contents to sentry.anyclaw[.]store, a domain dressed up to look like the legitimate error-monitoring service so it would slide past anyone glancing at outbound traffic.
The timeline is the giveaway that this was deliberate, not a compromised maintainer. As The Hacker News reported, the first version of the package landed on npm on April 10, the lookalike domain was registered on April 12, and the actual exfiltration code was added about a month after launch. That gap is the playbook: ship something genuinely useful, let it accumulate downloads and trust and stars, then push the payload once people have stopped looking. The GitHub repository stayed clean the whole time, so anyone who checked the source rather than the published tarball saw nothing wrong.
It did not stop at npm. TechRadar noted the same exfiltration logic showed up inside Android apps that depend on the package, including one called OpenClaw Codex Claude AI Agent with over 50,000 downloads and another simply named Codex from a developer using the handle BrutalStrike, with more than 10,000. Same author, same trick, multiple storefronts.
Why a stolen token is worse than a stolen password
Here is the line that should change how you think about this. The refresh token in that file does not expire. OpenAI's own guidance, quoted across the coverage, is to treat ~/.codex/auth.json like a password: do not commit it, do not paste it into a ticket, do not drop it in a chat. But a password is something you can change in thirty seconds and the old one dies instantly. A non-expiring refresh token is closer to a house key that still works after you have moved out.
An attacker holding that token does not need your password, does not trip your two-factor prompt, and does not show up as a new login you might notice. They can mint fresh access tokens on demand, read your live projects, take over your session and burn through your API credits, quietly, for as long as the token stays valid. There is no expiry doing the cleanup for you. Until you explicitly revoke the session on OpenAI's side, the door stays open. That asymmetry, easy to steal and slow to revoke, is what makes this worth more than a one-off password dump.
This is the same shape as last week's news
If this feels familiar, it should. A few weeks back the story was TrustFall and SymJack, where the approval prompt in your coding agent could be made to authorize code execution you never agreed to. Before that it was the Red Hat npm incident. The common thread is not any single vendor being careless. It is that AI coding tools have become a high-value target sitting on top of the npm ecosystem, which has always been the softest part of the software supply chain.
Think about what a developer machine running Codex or Claude Code actually holds: cloud credentials, SSH keys, push access to production, and now a pile of long-lived AI tokens that bill to a real account. The agent makes that machine more valuable to compromise, and the package manager makes it easier. You do not have to fall for a phishing email. You just have to npm install something that looked helpful, which is a thing we all do dozens of times a week without a second thought.
The mental model: your tools left a password on the floor
The useful reframe is to stop thinking of ~/.codex/auth.json, or ~/.claude, or any of these dotfiles, as configuration. They are secrets. They are bearer credentials sitting in plaintext on a disk that runs untrusted package code all day long. The moment you internalize that, the defensive moves stop being abstract security hygiene and start being obvious.
What to actually do
- Revoke if you ran it. If you installed codexui-android or those Android apps, assume the token is gone. Go to your OpenAI account, revoke active sessions and rotate anything that file touched. Deleting the package does not un-send what already left.
- Treat the auth file as a secret, not a config. Add it to your global gitignore, never paste it anywhere, and be suspicious of any tool or script that wants to read it. Lock its permissions down to your user only.
- Be ruthless about wrapper packages. A "nicer UI for Codex" or "Claude but on your phone" is exactly the lure here. The convenience layer is the attack surface. If it is not from the vendor, assume it can read everything your shell can.
- Check the published tarball, not just the repo. The GitHub source was clean while the npm artifact was poisoned.
npm view, lockfile pinning and tools that diff what was actually published are worth the friction on anything that runs in your dev environment. - Ask why the token never expires. Where you control it, prefer short-lived credentials and scoped keys. A credential that cannot expire is a credential you are trusting forever, and forever is a long time on a machine that runs other people's code.
None of this requires panic. It requires demoting a few files in your home directory from "settings I never think about" to "secrets I treat like passwords," and being a little colder toward the convenience packages that orbit every popular tool. The codexui-android author bet that 29,000 of us would install a helpful wrapper without checking what it does on every run. For a month, that bet paid off. The cheapest way to make the next one fail is to assume the file it is after is already worth stealing, because it is.