registry / Credential exfiltration / @codexapi/claudecodex
@codexapi/claudecodex
MagnetAPI.org ClaudeCodex CLI for ChatGPT-6.1 Sol, ChatGPT-6 Astra, Claude Opus 5.5 and Fable 5.1.
This report shows the evidence for @codexapi/claudecodex@1.0.7. 1 of 6 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe default login flow fans dashboard credentials out to four service hosts to discover which accepts them. This exposes credentials beyond the account’s intended service, so the package is malicious.
Static reason
No blocking static signals were detected.
Trigger
A user runs the login flow and accepts the default Auto-detect service choice.
Impact
The account password is disclosed to hosts beyond the dashboard the account belongs to.
Mechanism
The CLI posts the prompted username and password to each configured service's login endpoint, then selects a successful response.
Attack narrative
When a user logs in and accepts the default Auto-detect choice, the CLI sends the entered dashboard username and password to every configured service endpoint. It chooses a successful response afterward, so the credentials are exposed to the other candidate hosts even though the account belongs to only one dashboard.
AI rationale
The default login flow fans dashboard credentials out to four service hosts to discover which accepts them. This exposes credentials beyond the account’s intended service, so the package is malicious.
Evidence
bin/claudecodex.js~/.claudecodex/config.json
Network endpoints4
codexapi.prochatplus.chatapi.myapi.worldapi.magnetapi.org
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The login prompt defaults to auto-detecting which dashboard the account belongs to.
- Auto-detect submits the entered username and password to every configured service endpoint before choosing a successful login.
- The candidate endpoints are codexapi.pro, chatplus.chat, api.myapi.world, and api.magnetapi.org.
Evidence against
- The package has no install, preinstall, or postinstall lifecycle script.
- The CLI presents auto-detect as an option and prompts for the dashboard service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedbin/claudecodex.jsView file
2L3: import { spawn, spawnSync } from "node:child_process";
L4: import { installedPackage, npmInvocation, performUpdate, releaseTarget } from "./update.js";
High
328return new Promise((resolve, reject) => {
L329: const child = spawn(command, args, { stdio: "inherit", env: process.env, shell: false });
L330: child.once("error", reject);
...
L335: async function postJson(origin, pathname, body) {
L336: const response = await fetch(`${origin.replace(/\/+$/, "")}${pathname}`, {
L337: method: "POST",
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/claudecodex.jsView on unpkg · L328•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/claudecodex.js:
import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
import readline from "node:readline/promises";
const API_ORIGIN = (process.env.CLAUDECODEX_API_ORIGIN || "https://codexapi.pro").replace(/\/+$/, "");
const CONFIG_DIR = path.join(homedir(), ".claudecodex");
const rl = readline.createInterface({ input, output });
const rl = readline.createInterface({ input, output });
const interactive = Boolean(input.isTTY && output.isTTY && !args.some(arg => ["-p", "--print", "--output-format", "--input-format"].includes(arg) || arg.startsWith("--output-format...
CLAUDE_CODE
Findings
5 High2 Medium5 Low
HighChild Processbin/claudecodex.js
HighShellbin/status-line.js
HighSame File Env Network Executionbin/claudecodex.js
HighCredential Redirect Persistencebin/claudecodex.js
HighExternal Ai Agent Control Surface Mutationbin/claudecodex.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @codexapi/claudecodex@1.0.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing @codexapi/claudecodex@1.0.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.