codexui-android npm Supply Chain Attack — OpenAI Codex Auth Token Theft via sentry.anyclaw[.]store (friuns2 / BrutalStrike) — Threadlinqs Intelligence
As of 2026-06-01, codexui-android npm Supply Chain Attack — OpenAI Codex Auth Token Theft via sentry.anyclaw[.]store (friuns2 / BrutalStrike) is a high-severity supply chain threat attributed to friuns2, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-0641 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: friuns2 · FINANCIAL
The npm package codexui-android (27,000-29,000 weekly downloads), a remote web UI for OpenAI Codex by maintainer 'friuns'/'friuns2' (Igor Levochkin), was trojanized. From version 0.1.82,
codexui-android is an npm package providing a remote web/Android UI for OpenAI Codex, published by maintainer 'friuns' (also 'friuns2', identified as Igor Levochkin; GitHub/Play Store developer alias 'BrutalStrike'). The package first appeared as version 0.1.72 on 2026-04-10 and accumulated 27,000-29,000 weekly downloads. Approximately one month after initial release, beginning with version 0.1.82, the maintainer introduced credential-stealing code into the npm distribution only — the malicious logic is absent from the public GitHub repository (friuns2/codex-mobile), present exclusively in the published npm tarball's compiled dist-cli output.
The malicious behavior triggers at module load with zero user interaction. The CLI entrypoint dist-cli/index.js begins with `import "./chunk-PUR7OUAG.js";`, which fires before any application logic. That chunk reads the OpenAI Codex credential file at ~/.codex/auth.json (honoring the $CODEX_HOME environment variable when set). The full authentication JSON — containing access_token, refresh_token, id_token, and the account identifier — is XOR-encrypted with the hardcoded ASCII key 'anyclaw2026', then base64-encoded, and exfiltrated via an HTTPS POST to https://sentry.anyclaw[.]store/startlog. The request carries a User-Agent header of the form `codexui/{package_version}`. All errors are silently suppressed so the theft is invisible to the user. The exfiltration domain is deliberately named to masquerade as legitimate Sentry telemetry traffic, reducing the chance of analyst or proxy suspicion.
The stolen refresh_token is the critical asset: OpenAI Codex refresh tokens do not expire, so a single capture grants the attacker indefinite, silent impersonation of the victim's Codex/OpenAI account — including the ability to mint fresh access tokens, consume the victim's API quota/billing, and read code and prompts sent to Codex.
Delivery is multi-platform. The actor's Android app 'OpenClaw Codex Claude AI Agent' (package id gptos.intelligence.assistant, 50,000+ installs, ~26 MB) extracts a Termux-derived Linux userland and runs Node.js under a PRoot sandbox, then executes `pnpm add codexui-android@latest` with no version pinning — so every install/update silently pulls the trojanized build. The in-app Codex sign-in writes auth.json inside that sandbox; the package then reads it back out and exfiltrates it. A second paid app, 'Codex' (package id codex.app, 10,000+ installs), ships the identical exfiltration chain, uses the Kotlin namespace app.anyclaw.*, and registers the OAuth callback scheme anyclaw://auth/codex-callback.
The controlling domain anyclaw[.]store was registered on 2026-04-12, just two days after the first package version and weeks before the malicious code shipped — undermining the maintainer's later claim that the npm account had been compromised by a third party. Aikido Security discovered and publicly disclosed the campaign on 2026-05-27; the following day the author claimed in a GitHub issue (friuns2/codex-mobile #198) to have lost npm account access, a response later edited/deleted. The Hacker News and multiple outlets reported the campaign on 2026-06-01. At time of reporting the malicious package versions remained live on npm. This is classified as malware/supply-chain compromise rather than a CVE-class vulnerability; no CVE is assigned.
Weaknesses (CWE)
CWE-506, CWE-522, CWE-1357, CWE-829
Target sectors: technology, software-development, ai-ml, individual-developers, devops
Target regions: Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1583, T1586, T1608, T1587, T1195, T1195, T1059, T1204, T1027, T1036