A malicious npm package posing as a remote web UI tool for OpenAI Codex has been discovered in a supply-chain attack, exfiltrating authentication tokens from developers. The package, "codexui-android,…
A popular npm package for OpenAI Codex with 29,000 weekly downloads has been stealing developer authentication tokens for a month. The same credential-theft chain also ran through two Android apps wit…
A malicious npm package called codexui-android, disguised as a legitimate remote user interface for OpenAI Codex, exfiltrated developer authentication tokens by hiding malicious code in the published …
A malicious npm package named codexui-android, which amassed roughly 27,000 weekly downloads, secretly exfiltrated OpenAI Codex authentication tokens by sending the contents of users' auth.json files …
A malicious npm package named 'codexui-android' posing as a legitimate remote web UI for OpenAI Codex has been stealing authentication tokens from developers for the past month. The package, which ach…