Loading npm security reports…

@tokensrc/codex@1.14.34: Malicious npm security report (Block) | LPM Firewall

registry / @tokensrc/codex / 1.14.34

@tokensrc/codex@1.14.34

Standalone Codex account selection, authentication and launcher module.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

A user-run login captures complete OpenAI Codex credentials and uploads them to a non-OpenAI service. The package can subsequently install service-provided credentials into the user's Codex authentication file.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user runs the package's Codex login or account-selection commands.

Impact

A remote operator can receive reusable OpenAI refresh, access, and ID tokens and control the credentials used by Codex.

Mechanism

Credential capture, remote token-pool upload, and Codex auth-file replacement.

Attack narrative

When the user starts the package's login flow, it launches the official Codex login in a temporary home, reads the resulting auth.json, extracts complete refresh, access, and ID tokens, encrypts them for a server-selected key, and uploads the envelope to its token-pool service. Its default server is code-inbox.mcisaas.com. Other commands can write credentials returned by that service into Codex's auth.json, allowing the remote service to determine the credentials used by the official client.

AI rationale

This is concrete credential exfiltration and credential replacement functionality aimed at OpenAI Codex accounts. The lack of an install hook limits automatic execution but does not make the implemented token-harvesting behavior benign.

Evidence

dist/enrollment-login.jsdist/token-pool-v4-upload-flow.jsdist/managed-credential-v3-envelope.jsdist/config.jsdist/credentials.jsdist/commands.jsauth.jsonconfig.toml

Source & flagged code

5 flagged · loading source

dist/bin-app.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/bin-app.jsView on unpkg · L1

dist/release-process-shutdown.jsView file

22// Capture a process handle and verify creation time and SID again within L23: // PowerShell. No tree kill: only the explicitly confirmed process is affected. L24: if (!/^\d+$/u.test(item.startedAt))

High

Shell

Package source references shell execution.

dist/release-process-shutdown.jsView on unpkg · L22

assets/shortcut-bootstrap.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tokensrc/codex@1.14.7 matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.7 similarity = 0.359 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

assets/shortcut-bootstrap.cjsView on unpkg

408? `trusted Numa ${known.raw} is unavailable or corrupt; refusing to downgrade to ${installed.raw}. Restore network access or reinstall the shortcut from a trusted terminal.` L409: : "no verified local Numa release is available. Re-run `npx -y --prefer-online @numa-tech/numa@latest codex shortcut install` from a terminal with Node and npm."); L410: return; L411: } L412: const child = spawnSync(config.nodeExecutable, [selected, ...args], { L413: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

assets/shortcut-bootstrap.cjsView on unpkg · L408

dist/enrollment-login.jsView file

51const parsed = OneShotAuthFileSchema.safeParse(decoded); if (!parsed.success) { throw new CodexRuntimeError("Official Codex login did not produce complete ChatGPT credentials."); } return { idToken: parsed.data.tokens.id_token, accessToken: parsed.data.tokens.access_token, refreshToken: parsed.data.tokens.refresh_token,

High

Ai Review Evidence

The CLI invokes an isolated official Codex login, reads its auth.json, and extracts ID, access, and refresh tokens.

dist/enrollment-login.jsView on unpkg · L51