Listen to this Post
Introduction:
The modern software supply chain has a dangerous new arrow in its quiver: weaponized legitimacy. Unlike traditional malware that relies on typo-squatting or low-quality imitations, a newly discovered attack surrounding the `codexui-android` npm package reveals that developers are now being targeted by functional, polished tools that quietly embed a secret backdoor. This report dissects the mechanics of how this attack exfiltrated persistent `refresh_tokens` from unsuspecting users, why these tokens are more valuable than standard API keys, and provides a technical blueprint for detection and mitigation.
Learning Objectives:
- Understand the Supply Chain Kill Chain: Analyze how the `codexui-android` attack weaponized a legitimate GitHub repository to mask malicious publish-time code.
- Implement Technical Detection Techniques: Execute specific Linux and Windows commands to scan for credential exfiltration artifacts and identify malicious npm scripts.
- Apply Zero-Trust Token Practices: Learn to rotate credentials, audit dependency trees, and implement pre-commit hooks to prevent exposure to compromised AI tools.
You Should Know:
- Anatomy of the Breach: From `auth.json` to `sentry.anyclaw.store`
This attack represents a sophisticated inversion of standard trust models. The author built a legitimate remote UI for OpenAI Codex, complete with a public GitHub repository and active development. This “credible software” facade allowed the tool to achieve approximately 27,000 weekly downloads. However, the malicious logic was never stored in the public source code. Instead, the attacker published compromised versions to npm where the `dist-cli/index.js` entry point injected a hidden module.
Upon installation, the tool reads the user’s local authentication file located at ~/.codex/auth.json. It specifically targets the refresh_token. The exfiltration is masked as standard error monitoring:
– XOR Encryption: The token data is XOR-encrypted using the key "anyclaw2026".
– Traffic Blending: The data is POSTed to sentry.anyclaw.store/startlog, mimicking legitimate Sentry telemetry to bypass network monitoring.
– Persistence of the Refresh Token: Unlike short-lived access tokens, the stolen refresh token does not expire, granting the attacker permanent, silent access to the victim’s Codex environment, allowing them to generate new access credentials indefinitely.
Step‑by‑step guide to detecting the compromise:
To identify if your system has been exposed, run the following forensic commands depending on your operating system.
Linux/macOS (Detection & Analysis):
1. Check for the existence of the malicious package in your node_modules npm list codexui-android <ol> <li>Grep for the specific exfiltration endpoint inside installed packages grep -r "sentry.anyclaw.store" node_modules/</p></li> <li><p>Examine the auth.json file to see if it has been accessed recently (Linux) lsof | grep auth.json</p></li> <li><p>Review shell history for unauthorized XOR operations or curl commands cat ~/.bash_history | grep -E "curl|wget|xor|anyclaw"</p></li> <li><p>Check for active outbound connections to the malicious domain sudo netstat -anp | grep anyclaw.store
Windows (PowerShell – Detection):
1. Find all instances of the package
Get-ChildItem -Path C:\ -Filter "codexui-android" -Recurse -ErrorAction SilentlyContinue
<ol>
<li>Search for the malicious domain in code files
Get-ChildItem -Recurse -Include .js,.json | Select-String "sentry.anyclaw.store"</p></li>
<li><p>Check Codex token file location (WSL or User Profile)
If (Test-Path "$env:USERPROFILE.codex\auth.json") { Write-Host "Token file exists - Check permissions" }</p></li>
<li><p>Monitor firewall logs for outbound POST requests to unknown Sentry domains
Get-NetTCPConnection | Where-Object {$<em>.State -eq "Established" -and $</em>.RemotePort -eq 443}
- Immediate Hardening: API Key Rotation and Secret Scanning
The threat posed by stolen `refresh_tokens` is severe because they act as a skeleton key, bypassing password requirements indefinitely. If you suspect exposure, immediate revocation is critical. OpenAI automatically disables keys detected on public internet or app stores, but proactive in-house scanning is necessary.
Mitigation Playbook:
1. Revoke and Rotate (Manual):
- Navigate to platform.openai.com/api-keys.
- Locate the compromised key (or delete all keys associated with the account if unsure).
- Click “Revoke” or “Delete”.
- Immediately generate a new Project API key rather than a legacy key to utilize scoped permissions.
2. Automated Codebase Scanning (API_Protector):
To prevent committing sensitive keys to repos, integrate a local CLI scanner.
Linux/macOS: Clone and run API Key Guard git clone https://github.com/JasperBlank/API_Protector.git cd API_Protector python api_key_guard.py /path/to/your/codebase --fail-on high
This tool detects patterns for OpenAI (sk-...), Anthropic, AWS, and GitHub tokens, providing remediation steps for each finding.
3. Windows Pre-Commit Hook Integration:
Block leaks before they even reach GitHub using PowerShell.
Run as Administrator in PowerShell $p="$env:TEMP\install_pre_commit_hook.ps1"; irm https://raw.githubusercontent.com/JasperBlank/API_Protector/main/install_pre_commit_hook.ps1 -OutFile $p; powershell -ExecutionPolicy Bypass -File $p -RepoPath "C:\path\to\your\repo" -FailOn high
Once set, every `git commit` will automatically scan for secrets and block the commit if high-severity credentials (e.g., OPENAI_API_KEY=) are detected.
- Understanding the Token Economy: Why AI Credentials Are Prime Targets
The recent “Mini Shai-Hulud” worm (CVE-2026-45321) and the `codexui-android` attack highlight a shift from stealing data to stealing compute power. Attackers are not necessarily interested in your code; they want your API credits. OpenAI keys are the fastest-growing exposed secret on GitHub, with a 1,212% increase over two years. These keys are highly liquid assets that can be resold via illicit API syndicates or used to generate massive billing charges through automated content farms and crypto-mining via inference. Because API keys lack fine-grained expiration by default, a leak from a public Jupyter notebook or a compromised npm package can lead to financial ruin for a startup within hours. -
Defending the AI Pipeline: Dependency Auditing and Isolation
To defend against future variants of this attack, developers must adopt a “never trust, always verify” stance toward dependencies. This involves strict scrutiny of third-party tools before granting them access to development environments.
Step‑by‑step guide to securing your Node.js environment:
1. Implement `–ignore-scripts` (Critical Hardening):
The `codexui-android` payload fired immediately upon module load. Block this by disabling lifecycle scripts.
Install packages without allowing arbitrary code execution npm install --ignore-scripts Run a security audit focusing on high-risk dependencies npm audit --production --json
2. Linux Containerization (Docker Isolation):
Prevent token exfiltration by running AI tools in ephemeral containers without network access to sensitive files.
Create a restricted Dockerfile FROM node:18-alpine Run as non-root user RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001 USER nodejs Copy only the necessary build artifacts WORKDIR /app COPY --chown=nodejs:nodejs package.json ./ RUN npm ci --ignore-scripts CMD ["node", "index.js"]
Build and run with read-only root filesystem to prevent writes to sensitive token stores.
docker build -t safe-ai-tool . docker run --read-only --cap-drop=ALL --network none safe-ai-tool
- Windows Defender Application Guard (WDAG) & WSL Hardening:
For Windows environments, utilize WSL2 with restricted networking or sandboxed Windows containers.Enforce WSL2 configuration to limit outbound traffic (create/edit .wslconfig in user profile) [bash] networkingMode=mirrored localhostForwarding=false Use PowerShell to monitor .codex folder access in real-time (Requires Sysmon or Auditpol) auditpol /set /subcategory:"File System" /success:enable /failure:enable
-
Advanced Threat Hunting: The Unicode and Sourcemap Sleuthing
A key lesson from the `codexui-android` attack is that threat actors often leave forensic breadcrumbs. The attacker left sourcemaps in the published npm package, allowing researchers to trace the logic back tochunk-PUR7OUAG.js. Additionally, recent Codex vulnerabilities (patched February 2026) demonstrate that injection attacks can be hidden using Unicode homoglyphs—specifically, appending 94 Ideographic Space characters (U+3000) to a branch name to make malicious commands invisible to the user interface while the shell executes `curl` to exfiltrate tokens.
Defensive Regex Patterns for Detection:
- Unicode Smuggling: `[\u2000-\u2FFF]{5,}` (Look for excessive spacing characters in branch names or logs).
- Exfiltration Pattern:
https?:\/\/[a-zA-Z0-9.-]+\.(store|xyz|top)\/(log|collect|startlog). - Local Token Access: Pattern match `fs.readFileSync.auth\.json` or `process.env.OPENAI_API_KEY` concatenated with
https.request.
What Undercode Say:
- The “Trojan Horse” of the AI Era is Functionality. Attackers have learned that modern developers are trained to look for suspicious files, not suspiciously functional tools. The `codexui-android` malware worked exactly as advertised, making it virtually invisible to standard security training. The key takeaway is that tool legitimacy must be decoupled from trust; all third-party AI utilities must be treated as untrusted binaries.
- Refresh Tokens are the New Crown Jewels. While the security industry focuses on zero-day exploits, attackers are quietly harvesting persistent OAuth and Codex refresh tokens. These tokens are the ultimate persistence mechanism, surviving password changes and session terminations. Organizations must treat developer `auth.json` files with the same security rigor as SSH private keys, mandating hardware-based keystores for all AI authentication artifacts.
Prediction:
-
- Rise of “AI Security Gateway” Services: We will see a surge in proxy-based security layers (similar to Agent Vault) that sit between the developer IDE and the LLM API, stripping sensitive credentials and enforcing token expiration at the network edge.
-
- Shift to Deterministic Builds for AI Packages: The npm and PyPI ecosystems will likely accelerate the adoption of mandatory SLSA provenance and deterministic builds to prevent the “source-code-is-clean-but-distribution-is-poisoned” attack vector, forcing threat actors to move up the supply chain.
-
- Commoditization of API Credential Heists: As AI credits become a digital currency, expect a rise in RansomCompute attacks, where attackers demand payment not to decrypt files, but to stop burning thousands of dollars of stolen inference credits per minute.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mayura Kathiresh – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
