ACVE-2026-0409 · Malicious component · HIGH

Unverified · secondary sources only

WHAT HAPPENED

The package reads the local Codex auth.json and posts the access, refresh and id tokens, XOR-encoded, to a third-party server.

THE SETUP — is yours like this?

Harness: Any machine that installs or runs codexui-android 0.1.82 or later alongside a logged-in Codex CLI, www.aikido.dev
Model: any model, www.aikido.dev
Goal: not stated (unconfirmed)
Tools: The package entry point that runs on module load; the ~/.codex/auth.json (or $CODEX_HOME/auth.json) token file it reads; the sentry.anyclaw[.]store/startlog endpoint it posts to, www.aikido.dev
Approval: The exfiltration code runs at module load; no prompt or agent action is involved, www.aikido.dev

WHAT TO CHANGE

Uninstall codexui-android and revoke Codex sessions.

Remove npm:codexui-android. Every version from 0.1.82 exfiltrates Codex tokens (Aikido). Owner: operator

HARM, REACH AND RECOVERY

Harm: credential-theft

SOURCES

Technical details

A machine installs or runs codexui-android 0.1.82 or later alongside a logged-in Codex CLI; on module load the package reads the local Codex auth.json and posts its tokens to a third-party server.

Model as recorded: any

Severity: HIGH
Status: Unverified
Kind: Malicious component
Modified: 2026-09-25
Aliases: No CVE assigned — No CVE, GHSA or OSV entry was found for this package on 2026-09-21.
CVE boundary: supply-chain
Affected: npm: codexui-android — >= 0.1.82
Harness/product: codexui-android
Classes: supply-chain; credential-theft; CWE-506
Taxonomy: ASI: ASI04; ASI: ASI03; ATLAS: AML.T0011.001; ATLAS: AML.T0055; ATLAS: AML.T0083
First reported: 2026-05-27 — Aikido Security
Input controlled by: package-publisher
Divergence: none
Goal as recorded: Any install or update of the package (goal not stated by the source)
Licence: CC-BY-4.0 advisories; MIT code

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

In the wild

exploited-itw · 2026-04-13 · dfir, news

Description

What

Aikido found that from codexui-android@0.1.82 (published 2026-04-13) the entry point runs on module load, reads ~/.codex/auth.json (or $CODEX_HOME/auth.json) and posts the access, refresh and id tokens, XOR-encoded, to sentry.anyclaw[.]store/startlog. The npm maintainer is friuns; the source repository is friuns2/codex-mobile. Aikido also describes Android apps by the same author that pull codexui-android@latest at launch. The package was still on npm on 2026-09-21.

Detection

acve lock does not inventory npm installs, so this record has no matcher: check npm ls -g codexui-android by hand.

Fix

Uninstall the package, then sign out of Codex everywhere so the refresh token is revoked.

Report a problem JSON