June 4, 2026

A popular OpenAI Codex tool with 29,000 weekly downloads has been quietly stealing developer tokens for a month

a house made out of money on a white background — Kostiantyn Li / Unsplash

The npm package looked legitimate. It had an active GitHub repository, steady development history, and roughly 29,000 weekly downloads. For developers using OpenAI Codex, it offered exactly what it advertised: a remote web UI for the AI coding tool....