Loading story…
Researchers reported that the npm package codexui-android, presented as a legitimate remote web UI for OpenAI Codex, contained hidden credential-stealing code in the published package that was absent from its public GitHub repository. The malicious code read users’ auth.json files on startup, collected access, refresh, and ID tokens along with account identifiers, and exfiltrated them to sentry.anyclaw[.]store/startlog after obfuscation. The package reportedly reached about 27,000 weekly downloads, with malicious behavior appearing from version 0.1.82 and remaining active for roughly a month; researchers warned that the stolen refresh tokens could enable persistent account impersonation.
The campaign also spread through at least two Google Play apps, including OpenClaw Codex Claude AI Agent and codex.app/Codex, which installed codexui-android@latest at runtime inside a bundled Linux and Node.js environment. Reporting linked the publisher to the alias BrutalStrike and described the operation as a supply-chain attack that used a genuinely functional tool and established user base as cover for token theft. Defenders were urged to revoke and rotate exposed OpenAI Codex credentials and investigate systems for downloads of affected package versions and outbound traffic to the identified exfiltration domain.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Cyber Security News reported on Aikido's findings about the malicious codexui-android package, adding technical detail that the stolen auth.json contents were XOR-encrypted with the key "anyclaw2026" and base64-encoded before exfiltration. The article also noted Aikido linked the publisher to the alias "BrutalStrike."
The account lazarusholic shared ENKI's Kimsuky report on Bluesky, highlighting JSONPing, Webex spoofing, and a new HttpSpy variant. The posts served as public amplification of the previously published campaign details.
Aikido reported that codexui-android, a legitimate-looking remote UI for OpenAI Codex with about 27,000 weekly downloads, had been used in a supply-chain campaign to steal Codex authentication data. The report also said the package was delivered through at least two Google Play apps that installed codexui-android at runtime.
The npm package codexui-android introduced hidden code in published versions starting with 0.1.82 that read Codex auth.json data and exfiltrated tokens and account information to sentry.anyclaw.store/startlog on startup. The malicious code was present in the published package but not in the public GitHub repository.
ENKI published a report on Kimsuky distributing a malicious mobile app via QR code, describing themes including JSONPing, Webex spoofing, and a new HttpSpy variant. This marks the public disclosure of the campaign details in the provided references.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
5 references tracked. Mallory keeps watching after this page renders.
enki.co.kr
Open sourcecybersecuritynews.com
Open sourceaikido.dev
Open sourcebsky.app
Open sourcebsky.app
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ten malicious versions of **@7nohe/openapi-react-query-codegen**, a TanStack Query code generator with more than 150,000 weekly downloads, were published after an external GitHub user exploited its release workflow. The workflow accepted an exact npm-publish comment from any pull-request participant, checked out untrusted pull-request code, and used the repository's GitHub Actions OIDC trusted-publishing identity to release it; consequently, the malicious packages carried valid npm provenance attestations. At the time of reporting, npm's `latest` tag reportedly referenced malicious version `3.0.4`. The releases execute code during installation through preinstall hooks, malicious `binding.gyp` logic evaluated by `node-gyp`, or both, then launch an obfuscated second-stage payload. The malware downloads and executes Bun, probes Google Cloud metadata services, harvests credentials from cloud, GitHub, package registries, containers, Kubernetes, Vault, cryptocurrency wallets, messaging, VPN, and AI-development tools, and can propagate through accessible development environments; stolen data is exfiltrated through GitHub repositories labeled “Trinitite: Sponsored by Preview 2 Effects.” Organizations that installed affected versions with lifecycle scripts enabled should isolate and rebuild impacted systems, remove persistence and cached artifacts, and rotate all potentially exposed credentials from a clean environment using reviewed lockfiles and known-good releases.
Sep 1, 2026
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026