Poisoned npm Package Stole OpenAI Codex Tokens — and the GitHub Repo Looked Fine

The package had 27,000 weekly downloads, a tidy GitHub repository, and apparently useful functionality for OpenAI Codex users. None of that was the problem. The problem was what Aikido researchers found when they compared the published npm artifact against the public source: malicious token-exfiltration code present in one, absent in the other.

The package, codexui-android, collected access tokens, refresh tokens, ID tokens, and account IDs, then shipped them to an external server. A companion Android app compounded the exposure by pulling and executing the package at runtime — meaning the malicious payload ran without ever touching a code review queue.

Refresh tokens deserve a specific callout here. Under standard OAuth 2.0 flows (see RFC 6749, §6), a refresh token is the long-lived credential that lets a client obtain new access tokens silently. It doesn't expire on a short cycle. Steal one and you don't just own a session — you own the account until someone explicitly revokes it. Aikido put it plainly: a stolen Codex refresh token is "persistent, silent access to whatever that account can do."

This is an identity problem as much as a supply chain problem. Most supply chain security tooling — SAST, dependency scanning, code review — operates on source code. It has essentially no visibility into the delta between what a developer committed and what a registry actually distributes. Attackers who understand that gap can keep their public repositories spotless while injecting payloads directly into the published artifact. Standard audits catch nothing.

MFA wouldn't have closed this specific vector. The tokens were stolen post-authentication, after a legitimate login already issued them. Revocation controls and token-binding would help; most deployments don't enforce either.

The broader pattern Aikido describes is worth taking seriously: build a credible, useful project, accumulate a real user base, then let the artifact do the quiet work. Legitimacy is load-bearing to the attack. AI developer tooling is a high-value target precisely because the tokens it handles tend to be powerful and long-lived, attached to accounts with broad API access rather than narrow, scoped permissions.

Enterprises haven't caught up. Most lack a complete inventory of what credentials their AI tools inherit or which external services those tools call. The least-privilege disciplines applied to human identities — scoped permissions, short-lived tokens, behavioral anomaly detection — rarely extend to AI tooling yet. That asymmetry is the current exploit surface.