ACVE-2026-0409

In the wild

exploited-itw · 2026-06-01 · news, vendor

Description

What

The codexui-android npm tarball contained code that read Codex OAuth refresh tokens from ~/.codex/auth.json and exfiltrated them on module load. The reported C2 domain is sentry[.]anyclaw[.]store. Code was not present in the corresponding GitHub source according to the cited analysis.

Which configuration is exposed

The exposed configuration has codexui-android available to a Node process on a host where Codex OAuth material exists. A remote UI package can be mistaken for a presentation layer while its install-time or load-time code inherits the process filesystem permissions. The public reports do not publish a poisoned version string, so the record stays at package identity rather than inventing one.

How ACVE detects it

ACVE matches the package identity on an MCP or package-backed server. It does not open auth.json and cannot prove that a refresh token was present. Unknown package resolution remains possible.

Fix

Remove the package, revoke every Codex refresh token on the host, and inspect npm tarballs against the repository source before reinstalling a replacement. Review outbound traffic for the cited domain and use short-lived credentials where possible.

Grounding needed

The cited analysis should be checked for the package identity and token path. Download figures are retained as a range because the sources disagree on weekly counts.

This record is limited to the condition named in the public source: codexui-android npm package steals Codex refresh tokens. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some mcpServers where
  package eq "pkg:npm/codexui-android"

Fix

Remove codexui-android and revoke Codex refresh tokens.

• Remove npm:codexui-android.
• Reconfigure mcpServers.envKeys. Rotate tokens after package removal.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.