Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens

What it is

codexui-android, a real npm package providing a remote web UI for OpenAI Codex — active GitHub repo, ~27,000 weekly downloads — whose published versions have (for about the past month) silently exfiltrated Codex OAuth credentials. The exfil code exists only in the npm build, not the GitHub source. The author (identifying as "BrutalStrike") also ships it via Android apps on Google Play.

How it works

The entry point dist-cli/index.js imports ./chunk-PUR7OUAG.js on its first line, so the payload fires at module load before any application code. On every startup it reads the full ~/.codex/auth.json (or $CODEX_HOME/auth.json), and if an access_token or refresh_token is present, XOR-encrypts the whole file with key anyclaw2026, base64-encodes it, and POSTs it to sentry.anyclaw[.]store/startlog. The sentry.* hostname is deliberately chosen to blend with the package's legitimate Sentry telemetry; request errors are suppressed silently. Stolen data: access_token, refresh_token, id_token, and account ID. The non-expiring refresh_token allows indefinite silent impersonation. Sourcemaps left in the package include the author comment "Send tokens to our startlog endpoint (always...)".

Preconditions / Affected

• Any install of codexui-android from npm (versions published in roughly the last month); the exfil is present since codexui-android@0.1.82. GitHub source auditing will not reveal it.
• Google Play apps by the same author that bootstrap the package unpinned (pnpm add codexui-android@latest) via a Termux/PRoot Node.js userland: "OpenClaw Codex Claude AI Agent" (gptos.intelligence.assistant) and "Codex" (codex.app, 10K+ installs). Both use the app.anyclaw.* namespace, bundle rootfs.tar.zst.bin, and register anyclaw://auth/codex-callback. On these, signing in inside the app writes auth.json into the sandbox, which the package then ships out.

The author's other three Play apps (Brutal Strike, Ai Trip Planner Maps, FacePoke) do not contain this chain.

What to do

The page states no formal patch or removal command. Actionable IoCs to hunt and block:

• Network egress to sentry.anyclaw[.]store / path /startlog.
• Presence of codexui-android in npm dependencies, or chunk-PUR7OUAG.js in dist-cli/.
• The installed Play apps above; the callback scheme anyclaw://auth/codex-callback.
• Rotate any Codex credentials exposed to these — the refresh_token does not expire, so uninstalling alone does not revoke attacker access.

Caveats

Detection relied on sourcemaps the attacker left in — a cleaner build would have been harder to confirm. When contacted, the author claimed to have lost npm account access and asked Aikido to remove the package, then posted a replacement statement that does not address the findings; attribution and current package status are therefore unsettled.