Malicious npm Package codexui-android Pulls 29K Weekly Downloads, Targets OpenAI Codex Tokens

A typosquat-adjacent npm package called codexui-android, marketed as a remote web UI for OpenAI Codex, is exfiltrating authentication tokens from developers who install it. Weekly downloads sit north of 29,000. At time of writing, the package remains available on both npm and GitHub.

The lure is straightforward: a slick GitHub repo, a passable README, and an install path that looks like every other Codex helper tool shipped over the last six months. Developers running Codex against their own OpenAI accounts — or worse, against their employer's enterprise tenant — are the intended marks.

The operational impact is the part defenders should focus on.

Stolen OpenAI tokens grant access to billed API usage, fine-tuned models, and any data flowing through the account's recent Codex sessions. That includes source code snippets, prompts containing internal logic, and whatever else a developer pasted into the IDE that day. For shops where Codex sits wired into CI or a code-review bot, the token is effectively a build-system credential.

This is the second-stage problem with the npm ecosystem nobody wants to fix. A package with 29K weekly downloads gets installed transitively, pinned into lockfiles, and mirrored into private registries before anyone audits the postinstall script. Removal from the public registry doesn't undo any of that.

What to do right now if codexui-android appears anywhere in your dependency graph:

• Revoke and rotate every OpenAI API key that touched a machine where the package was installed. Check the OpenAI API key dashboard for unfamiliar key activity and usage spikes.
• Audit package-lock.json, pnpm-lock.yaml, and yarn.lock across repos — not just package.json. Transitive pulls are how these things hide.
• Pull CI logs for outbound connections from build agents during install steps. Token exfil typically rides a single HTTPS POST.
• Treat any model fine-tunes or stored files in the affected OpenAI account as potentially exposed until proven otherwise.

The broader pattern here is familiar to anyone who watched the eslint-scope, event-stream, or more recent lottie-player incidents play out. Attackers no longer bother with obscure utility packages. They go straight for whatever tooling is trending on developer Twitter that week — right now, that's anything with "Codex," "Claude," or "MCP" in the name.

No CVE has been assigned at publication. The package has not been pulled by the registry maintainers (npm's malware team typically acts within 24–48 hours of a credible report; the clock appears to have started). Researchers who flagged the campaign have not yet published a full IOC list, but the package name itself is the primary indicator.

If you run an internal npm proxy, block the name now. Don't wait for the registry takedown.