A popular OpenAI Codex tool with 29,000 weekly downloads has been quietly stealing developer tokens for a month
TL;DR
A popular npm package for OpenAI Codex with 29,000 weekly downloads has been stealing developer authentication tokens for a month. The same credential-theft chain also ran through two Android apps with over 60,000 combined downloads.
The npm package looked legitimate. It had an active GitHub repository, steady development history, and roughly 29,000 weekly downloads. For developers using OpenAI Codex, it offered exactly what it advertised: a remote web UI for the AI coding tool.
But for the past month, every invocation of codexui-android has also been silently reading the contents of the user’s Codex authentication file and shipping it to an attacker-controlled server. The stolen data includes access tokens, refresh tokens, ID tokens, and account IDs, everything needed to impersonate the developer indefinitely.
“The refresh_token doesn’t expire,” Aikido Security researcher Charlie Eriksen wrote. “An attacker holding it can silently impersonate you indefinitely.”
How...
Copyright of this story solely belongs to thenextweb.com. To see the full text click HERE
