codexui-android npm Supply Chain Attack — OpenAI Codex Auth Token Theft via sentry.anyclaw[.]store (friuns2 / BrutalStrike)
codexui-android npm Supply Chain Attack (TL-2026-0641), also tracked as codexui-android token theft, is a high-severity supply-chain compromise, first published 2026-06-01. It is attributed to BrutalStrike with medium confidence, affects friuns2 (npm) codexui-android (npm package), maps to 17 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-0641
- Threat ID
- TL-2026-0641
- Also known as
- codexui-android token theft, anyclaw Codex token stealer
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-01
- Last reviewed
- 2026-06-01
- Attribution
- BrutalStrike
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, ai-ml, individual-developers, devops
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
The npm package codexui-android (27,000-29,000 weekly downloads), a remote web UI for OpenAI Codex by maintainer 'friuns'/'friuns2' (Igor Levochkin), was trojanized. From version 0.1.82, dist-cli/index.js reads ~/.codex/auth.json on module load, XOR-encrypts it with key 'anyclaw2026', base64-encodes it, and POSTs the full OAuth blob (access_token, refresh_token, id_token, account_id) to sentry.anyclaw[.]store/startlog. Because the Codex refresh_token does not expire, the attacker gains persistent, silent account impersonation. The same actor ships Android apps (50,000+ installs) that drag the unpinned malicious npm build onto devices via a Termux/PRoot Node.js userland.
How codexui-android npm Supply Chain Attack works
codexui-android is an npm package providing a remote web/Android UI for OpenAI Codex, published by maintainer 'friuns' (also 'friuns2', identified as Igor Levochkin; GitHub/Play Store developer alias 'BrutalStrike'). The package first appeared as version 0.1.72 on 2026-04-10 and accumulated 27,000-29,000 weekly downloads. Approximately one month after initial release, beginning with version 0.1.82, the maintainer introduced credential-stealing code into the npm distribution only — the malicious logic is absent from the public GitHub repository (friuns2/codex-mobile), present exclusively in the published npm tarball's compiled dist-cli output.
The malicious behavior triggers at module load with zero user interaction. The CLI entrypoint dist-cli/index.js begins with `import "./chunk-PUR7OUAG.js";`, which fires before any application logic. That chunk reads the OpenAI Codex credential file at ~/.codex/auth.json (honoring the $CODEX_HOME environment variable when set). The full authentication JSON — containing access_token, refresh_token, id_token, and the account identifier — is XOR-encrypted with the hardcoded ASCII key 'anyclaw2026', then base64-encoded, and exfiltrated via an HTTPS POST to https://sentry.anyclaw[.]store/startlog. The request carries a User-Agent header of the form `codexui/{package_version}`. All errors are silently suppressed so the theft is invisible to the user. The exfiltration domain is deliberately named to masquerade as legitimate Sentry telemetry traffic, reducing the chance of analyst or proxy suspicion.
The stolen refresh_token is the critical asset: OpenAI Codex refresh tokens do not expire, so a single capture grants the attacker indefinite, silent impersonation of the victim's Codex/OpenAI account — including the ability to mint fresh access tokens, consume the victim's API quota/billing, and read code and prompts sent to Codex.
Delivery is multi-platform. The actor's Android app 'OpenClaw Codex Claude AI Agent' (package id gptos.intelligence.assistant, 50,000+ installs, ~26 MB) extracts a Termux-derived Linux userland and runs Node.js under a PRoot sandbox, then executes `pnpm add codexui-android@latest` with no version pinning — so every install/update silently pulls the trojanized build. The in-app Codex sign-in writes auth.json inside that sandbox; the package then reads it back out and exfiltrates it. A second paid app, 'Codex' (package id codex.app, 10,000+ installs), ships the identical exfiltration chain, uses the Kotlin namespace app.anyclaw.*, and registers the OAuth callback scheme anyclaw://auth/codex-callback.
The controlling domain anyclaw[.]store was registered on 2026-04-12, just two days after the first package version and weeks before the malicious code shipped — undermining the maintainer's later claim that the npm account had been compromised by a third party. Aikido Security discovered and publicly disclosed the campaign on 2026-05-27; the following day the author claimed in a GitHub issue (friuns2/codex-mobile #198) to have lost npm account access, a response later edited/deleted. The Hacker News and multiple outlets reported the campaign on 2026-06-01. At time of reporting the malicious package versions remained live on npm. This is classified as malware/supply-chain compromise rather than a CVE-class vulnerability; no CVE is assigned.
MITRE ATT&CK techniques used in TL-2026-0641
Collection
T1005 Data from Local System; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1573 Encrypted Channel
Initial Access
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
defense-impairment
Affected products and versions in codexui-android npm Supply Chain Attack
- friuns2 (npm) — codexui-android (npm package)
Vulnerable versions: 0.1.82; >=0.1.82 (malicious dist-cli build)
Fixed in: clean GitHub source friuns2/codex-mobile (no malicious code) - BrutalStrike (Google Play) — OpenClaw Codex Claude AI Agent (gptos.intelligence.assistant)
Vulnerable versions: all builds pulling codexui-android@latest - BrutalStrike (Google Play) — Codex (codex.app)
Vulnerable versions: builds shipping the codexui-android exfil chain - OpenAI — OpenAI Codex (auth.json OAuth tokens)
Vulnerable versions: any account whose ~/.codex/auth.json was read on an affected host
Remediation for codexui-android npm Supply Chain Attack
Patches
- No vendor patch — remove the malicious package. Use only the clean upstream GitHub source if rebuilding, never the npm dist-cli build of affected versions
Immediate actions
- Uninstall codexui-android immediately; treat any host that ran version >= 0.1.82 as compromised
- Revoke and rotate all OpenAI/Codex credentials: sign out everywhere and re-authenticate to invalidate the stolen refresh_token, then delete and recreate ~/.codex/auth.json
- Rotate any OpenAI API keys associated with the affected account and review billing/usage for anomalous Codex activity
- Uninstall the Android apps 'OpenClaw Codex Claude AI Agent' (gptos.intelligence.assistant) and 'Codex' (codex.app)
- Block sentry.anyclaw[.]store and *.anyclaw[.]store at DNS/proxy/egress perimeter
Workarounds
- Set $CODEX_HOME to a directory outside any untrusted package's reach and audit file access to auth.json
- Run Codex auth flows on hosts that do not execute community npm CLI tooling
Longer-term hardening
- Pin npm/pnpm dependency versions and use lockfiles with integrity hashes; disable automatic 'latest' resolution in build/runtime scripts
- Enforce npm install with --ignore-scripts where feasible and review packages that read credential files at module-load time
- Deploy egress filtering and DNS monitoring to flag credential-file reads followed by outbound POSTs to newly-registered domains
- Adopt short-lived/rotating tokens and bind tokens to device/session where the provider supports it
Weaknesses (CWE) in codexui-android npm Supply Chain Attack
CWE-506, CWE-522, CWE-1357, CWE-829
Timeline of codexui-android npm Supply Chain Attack
- codexui-android first published to npm as version 0.1.72 by maintainer 'friuns'/'friuns2' (Igor Levochkin).
- Attacker registers controlling domain anyclaw[.]store, two days after the first package version and weeks before malicious code ships.
- Credential-stealing code introduced into the npm dist-cli build starting at version 0.1.82 (absent from the public GitHub repo); silent exfiltration begins.
- Aikido Security discovers and publicly discloses the campaign, detailing the auth.json theft and sentry.anyclaw[.]store/startlog exfiltration.
- Author claims in GitHub issue friuns2/codex-mobile #198 to have lost npm account access; response later edited/deleted. Multiple outlets (hackread, cybernews, cybersecuritynews, gbhackers) report.
- Threadlinqs Intelligence publishes TL-2026-0641 with full IOC, MITRE, and detection coverage.
- The Hacker News reports the campaign; malicious package versions remain live on npm at time of reporting (~29,000 weekly downloads).
Sources cited for codexui-android npm Supply Chain Attack
- Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens
- OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack
- Credential exfiltration code found in published npm package (Issue #198)
- 27,000-Download Codex UI Tool Secretly Stole OpenAI Refresh Tokens
- Hackers caught hiding OpenAI token-stealing malware in Codex npm package
- Legitimate-Looking Codex Remote UI Steals OpenAI Codex Authentication Tokens
- Fake Codex Remote UI Steals OpenAI Auth Tokens
Threats related to codexui-android npm Supply Chain Attack
Detection coverage for TL-2026-0641
As of 2026-06-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0641 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.