{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0409",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "codexui-android npm package steals Codex refresh tokens",
  "details": "## What\n\nThe codexui-android npm tarball contained code that read Codex OAuth refresh tokens from ~/.codex/auth.json and exfiltrated them on module load. The reported C2 domain is sentry[.]anyclaw[.]store. Code was not present in the corresponding GitHub source according to the cited analysis.\n\n## Which configuration is exposed\n\nThe exposed configuration has codexui-android available to a Node process on a host where Codex OAuth material exists. A remote UI package can be mistaken for a presentation layer while its install-time or load-time code inherits the process filesystem permissions. The public reports do not publish a poisoned version string, so the record stays at package identity rather than inventing one.\n\n## How ACVE detects it\n\nACVE matches the package identity on an MCP or package-backed server. It does not open auth.json and cannot prove that a refresh token was present. Unknown package resolution remains possible.\n\n## Fix\n\nRemove the package, revoke every Codex refresh token on the host, and inspect npm tarballs against the repository source before reinstalling a replacement. Review outbound traffic for the cited domain and use short-lived credentials where possible.\n\n## Grounding needed\n\nThe cited analysis should be checked for the package identity and token path. Download figures are retained as a range because the sources disagree on weekly counts.\n\nThis record is limited to the condition named in the public source: codexui-android npm package steals Codex refresh tokens. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "codexui-android"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "supply-chain",
        "credential-theft"
      ],
      "cwe": [
        "CWE-522"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://thehackernews.com/2026/06/openai-codex-authentication-tokens.html",
            "type": "news"
          },
          {
            "url": "https://www.aikido.dev/blog/codex-remote-ui-steals-ai-tokens",
            "type": "vendor"
          }
        ],
        "kev": {
          "listed": false
        },
        "last_seen": "2026-06-01",
        "victims": {
          "range": "27-29k weekly downloads",
          "sectors": [
            "software"
          ],
          "evidence": "The sources describe token theft on module load; weekly downloads are an exposure measure rather than confirmed victims."
        },
        "attribution": "unattributed"
      },
      "cveBoundary": "supply-chain",
      "matcher": {
        "some": "mcpServers",
        "where": {
          "field": "package",
          "op": "eq",
          "value": "pkg:npm/codexui-android"
        }
      },
      "fix": {
        "summary": "Remove codexui-android and revoke Codex refresh tokens.",
        "actions": [
          {
            "type": "remove",
            "target": "npm:codexui-android"
          },
          {
            "type": "reconfigure",
            "target": "mcpServers.envKeys",
            "why": "Rotate tokens after package removal."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:17:38Z",
          "sources": [
            {
              "url": "https://thehackernews.com/2026/06/openai-codex-authentication-tokens.html",
              "status": 200,
              "contentType": "text/html; charset=UTF-8",
              "sha256": "sha256:29f5b219affa78e665e06aa6de05f45f3585c53abcda3cb09e348a515defddcd",
              "type": "news"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}