OpenAI Codex Authentication Tokens Stolen in Codexui-Android Npm Supply Chain Attack

Why It Matters

Stolen Codex refresh tokens provide perpetual, silent access to OpenAI’s AI models, jeopardizing proprietary code and data across the software supply chain. The attack demonstrates how trusted developer tools can become covert vectors for credential theft, raising urgent security concerns for AI‑centric organizations.

Key Takeaways

• codexui-android npm package exfiltrates Codex auth.json tokens to attacker server
• Over 29,000 weekly downloads expose many developers to token theft
• Refresh tokens never expire, granting indefinite access to OpenAI Codex accounts
• Two BrutalStrike Android apps embed malicious npm package, each with thousands downloads
• Revocation delays let attackers exploit deleted keys, seen with Google and AWS

Pulse Analysis

The codexui-android incident underscores a new wave of supply‑chain compromises that embed malicious code in legitimate, actively maintained packages. Unlike classic typosquatting, the attacker waited a month after the package’s initial release to insert credential‑stealing logic, leveraging the trust built through 29,000 weekly downloads. By targeting the plaintext auth.json file used by OpenAI’s CLI and IDE extensions, the threat actor harvests refresh tokens that never expire, granting indefinite impersonation of any Codex user. This method bypasses typical token‑revocation safeguards, because the stolen refresh token can regenerate access tokens at will.

Mobile developers are not immune. The same malicious npm module is executed inside a sandboxed Linux environment launched by two Android applications published by BrutalStrike, each with tens of thousands of installs. The apps pull the latest npm version, meaning any future malicious update could instantly affect all downstream users. This cross‑platform delivery amplifies the attack surface, turning a single compromised package into a multi‑device credential‑theft engine. Security teams must therefore monitor not only npm dependencies but also any third‑party binaries that may embed them.

The broader lesson extends to cloud credential management. Recent findings of exploitable windows after key deletion—such as Google’s 23‑minute and AWS’s 4‑second revocation delays—show that lingering credentials are a systemic risk. Organizations should implement real‑time revocation checks, enforce short‑lived tokens, and treat credential files like passwords, storing them in encrypted vaults rather than plaintext. As AI tooling becomes integral to software development, proactive supply‑chain hygiene and robust credential hygiene will be essential to safeguard intellectual property and maintain trust in emerging technologies.