Affected Systems
npm package codexui-android (all versions). Targets developers using OpenAI Codex APIs. Affects organizations with Node.js/npm development environments where this package was installed.
Exploitation Status
Active exploitation confirmed. The malicious package was live on npm and achieved 29,000 weekly downloads before disclosure. Threat actors successfully harvested OpenAI authentication tokens from compromised developer environments.
Business Impact
Stolen OpenAI API tokens enable unauthorized access to organization OpenAI accounts, leading to API quota abuse, data exfiltration of prompts/responses, financial impact from unauthorized usage, and potential exposure of proprietary code or sensitive data sent to OpenAI services. Developers who installed codexui-android have compromised credentials requiring immediate rotation.
Urgency
🔴 Immediate
Recommended Actions
- Immediately audit all Node.js projects and CI/CD pipelines for the codexui-android package using 'npm ls codexui-android' and remove if present
- Rotate all OpenAI API keys and authentication tokens for any developer or system that may have installed this package
- Review OpenAI API usage logs for anomalous activity, unexpected geographic access, or quota spikes during the exposure window
- Implement npm package integrity checks using tools like npm audit, Snyk, or Socket Security to detect malicious dependencies
- Restrict npm package installation to approved registries and require security review for new dependencies in development workflows