Coding agents are changing the attack surface of software teams. They read repositories, run commands, install dependencies, handle tokens and sometimes run in environments close to CI or the main development machine. The codexui-android incident, documented in late May 2026 by Aikido Security, is a sharp reminder: a seemingly useful AI tool can become a classic supply chain attack vector, with its impact amplified by the privileges granted to coding assistants.
Verified facts
On May 27, 2026, Aikido Security published an analysis titled "Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens", updated on May 28. According to Aikido, the package published on npm under the name codexui-android presented itself as a remote web interface for OpenAI Codex. The associated GitHub repository looked clean, but the package published on npm contained malicious code.
The reported behavior is specific: the package tried to read ~/.codex/auth.json or $CODEX_HOME/auth.json, then exfiltrate data to sentry.anyclaw.store/startlog. The fields mentioned by Aikido include access_token, refresh_token, id_token and an account identifier. Aikido states that the exfiltration had been present since codexui-android@0.1.82.
The incident was then cross-checked by several sources. The Hacker News reported on June 1, 2026 that the package was functional and wasn't a simple case of typosquatting. The article also confirms the significant gap between a clean GitHub repository and an artifact published on npm with malicious code. Snyk classifies codexui-android as a malicious package and describes the theft of Codex OAuth credentials from ~/.codex/auth.json, sent to sentry.anyclaw.store.
Aikido cites about 27,000 weekly downloads at the time of its analysis. The Hacker News and TechRadar mention more than 29,000 weekly downloads. These figures give an order of magnitude of the potential exposure, but they don't prove the number of victims or the exact number of compromised installations. A download from npm isn't a certain compromise.
Another important element: according to Aikido, an Android app named OpenClaw Codex Claude AI Agent pulled codexui-android@latest via pnpm in a Termux/PRoot environment. Aikido also mentions another Codex app with more than 10,000 installs, while stating that the other apps examined didn't rely on this infrastructure. Cloud Security Alliance Lab Space adds an analysis of the AI supply chain risk, mentions the @friuns/codexui variant and the friuns account on the npm registry, and stresses the need to treat auth.json as a secret.
Analysis
The most worrying point isn't just that an npm package was malicious. That happens regularly in the JavaScript ecosystem. The real signal here is the perfect fit between the target and the new usage patterns: a Codex-related package, installed by users who already work with coding agents, and able to go straight for the tool's local authentication file.
Teams often have decent maturity on production application dependencies: lock files, scans, reviews, pipelines, separation of secrets. Developer productivity tools, however, still too often escape this control. Editor extensions, agent CLIs, npm wrappers, local web interfaces, Android integrations, install scripts copied from GitHub: all of this is sometimes treated as personal convenience, not as a critical dependency.
That's the wrong mental model. A coding agent often has more operational capability than a classic backend dependency. It can read source code, run builds, inspect environment variables, access configuration files, modify files, trigger Git commands and interact with remote services. If the agent or its interface is compromised, the attack doesn't just hit one application: it hits the workstation, the secrets, the repositories and sometimes the CI/CD pipelines.
The other lesson is the limit of the "I checked GitHub" reflex. In this incident, sources report that the GitHub repository was clean while the published npm package was not. For a developer in a hurry, a credible public repository, a working interface and visible downloads can be enough to build trust. Yet the modern supply chain can't be verified only at the level of the displayed source code: it has to be verified at the level of the artifact actually installed.
Using @latest makes this risk worse. Installing a moving dependency in an environment that holds tokens means letting the package publisher decide, at every install, what code runs locally. That isn't acceptable for tools with access to secrets. Even for a small team, pinning versions isn't bureaucratic sophistication: it's a simple barrier against uncontrolled changes.
Finally, this incident illustrates a broader risk often called LLMjacking: the fraudulent use of accounts, tokens or quotas tied to AI services. If a Codex token or similar gives access to paid resources, account data or automation capabilities, stealing it can lead to costs, leaks or unauthorized actions. We should stay cautious about the exact consequences without knowing the affected environments, but the principle is clear: an AI agent token is a production secret, even if it lives on a development machine.
Recommendations
The first measure is an inventory. List the AI tools installed on development machines and environments: CLIs, VS Code or JetBrains extensions, global npm packages, local wrappers, development-related mobile apps, scripts defined in package.json, containers and images used for agents. For freelancers, this can fit in a simple, up-to-date file. For a small team, add an owner, an approved version and a review date.
Next, audit existing installations. Explicitly search for codexui-android and @friuns/codexui in lock files, shell histories, Termux/PRoot environments, pnpm, npm or yarn scripts, and global directories. If codexui-android was installed, notably version 0.1.82 or the version resolved by @latest, consider the Codex tokens on the machine as exposed. The prudent response is to immediately rotate or revoke the affected credentials, then check the available access logs.
Don't just check GitHub. For sensitive npm packages, inspect the published archive: npm pack, the package contents, preinstall and postinstall scripts, generated files, differences from the source repository, transitive dependencies. The goal isn't to turn every developer into a malware analyst, but to have a stricter procedure for tools that touch secrets, agents or CI.
Avoid @latest for AI tools. Pinning versions, keeping a lock file and updating deliberately after review greatly reduces exposure to silent changes. For test or demo environments, the convenience of @latest may seem acceptable; for an agent able to read tokens, it isn't.
Control outbound network traffic from sensitive machines and CI. Exfiltration to a domain disguised as a monitoring endpoint, like the one reported in this incident, becomes harder if build and agent environments don't have unlimited outbound access. In practice: a domain allowlist where possible, DNS/HTTP logs, alerts on new destinations, and separation between personal machine, agent environment and CI.
Isolate agents. A coding agent should ideally run in a sandbox, a container, a VM or a limited-privilege environment, with a bounded working directory and minimal secrets. The principle is simple: if the agent or a plugin is compromised, it shouldn't be able to read the whole home directory, every repository, every token and every SSH key.
Shorten the lifetime of secrets. Long-lived tokens stored in plain text in local files are convenient, but they increase the impact of a theft. When the ecosystem allows it, prefer the operating system keychain, short-lived sessions, narrowly scoped tokens and easy revocation. Failing that, treat files like auth.json as seriously as a production .env.
For founders and freelancers, the adoption policy should be short but explicit. For example: no new AI agent or wrapper tool without checking the maintainer, a pinned version, a review of the published package, execution in an isolated environment, and no unnecessary permanent secrets. It isn't heavy: it's the minimum to avoid turning a productivity tool into uncontrolled privileged access.
What not to conclude too quickly
You shouldn't conclude that all Codex users are compromised. The sources talk about a specific package, specific versions and a specific installation method. Nor should all npm downloads automatically be counted as victims. Download metrics often overstate real usage and say nothing, on their own, about whether the code actually ran.
It is reasonable, however, to conclude that coding agent workflows have become a profitable target. The codexui-android incident isn't just a one-off alert; it's a concrete example of what happens when AI tooling moves faster than the security practices that should frame it.
FAQ
What should I do if I installed codexui-android?
Uninstall the package, identify the installed version and consider the Codex tokens on the machine as potentially exposed. Revoke or rotate the affected credentials, check the recent access logs available, then inspect your scripts, lock files and global installs to avoid a reinstall.
Is checking the GitHub repository enough?
No. In this incident, the sources state that the GitHub repository was clean while the published npm package contained the malicious code. For sensitive tools, you have to check the artifact actually installed, not just the source repository.
Why is @latest risky?
Because it delegates the choice of version to install time. If a malicious version is published, an environment using @latest can install it without any explicit decision from the team. For agents and tools with access to secrets, versions should be pinned.
Should AI agent tokens be treated as production secrets?
Yes. Even when used on a development machine, they can give access to accounts, quotas, automation capabilities or sensitive data. They must be protected, limited, monitored and revocable.
What's the most important measure for a small team?
Start with an inventory of AI tools and one simple rule: no agent tool runs with permanent secrets and full access to the machine without a minimal review, a pinned version and isolation. It's pragmatic, cheap and immediately useful.