registry / @tokensrc/codex / 1.23.1

@tokensrc/codex@1.23.1

⚠ Under review

Standalone Codex account selection, authentication and launcher module.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 46 file(s), 668 KB of source, external domains: api.openai.com, auth.openai.com, chatgpt.com, code-inbox.mcisaas.com, kc.mcisaas.com, platform.example, registry.npmjs.org, www.apple.com

Source & flagged code

7 flagged

dist/bin-app.jsView file

Lines 1-12javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/bin-app.jsView on unpkg · L1

4const child = spawn(process.execPath, [fileURLToPath(new URL("./cli.js", import.meta.url)), "app", ...process.argv.slice(2)], {

5 stdio: "inherit",

6 env: process.env

7});

8process.exitCode = await new Promise((resolve, reject) => {

9 child.once("error", reject);

10 child.once("exit", (code, signal) => resolve(signal ? 128 : (code ?? 1)));

11});

12//# sourceMappingURL=bin-app.js.map

•matchType = normalized_sha256 matchedPackage = @tokensrc/codex@1.14.45 matchedPath = dist/bin-app.js matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin-app.jsView on unpkg

assets/shortcut-bootstrap.cjsView file

Lines 388-428javascript

388 const next = { ...current, nextCheckAt: Date.now() + FAILURE_CHECK_INTERVAL_MS };

389 writeState(config, next);

390 return next;

391 }

dist/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = @tokensrc/codex@1.14.45 matchedPath = dist/runtime.js matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime.jsView on unpkg

dist/bin-run.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin-run.jsView on unpkg

dist/release-process-shutdown.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tokensrc/codex@1.14.32 matchedIdentity = npm:QHRva2Vuc3JjL2NvZGV4:1.14.32 similarity = 0.843 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/release-process-shutdown.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/bin-app.jsView file

@tokensrc/codex@1.23.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code