A popular OpenAI Codex tool with 29,000 weekly downloads has been quietly stealing developer tokens for a month (opens in new tab)

The npm package looked legitimate. It had an active GitHub repository, steady development history, and roughly 29,000 weekly downloads. For developers using OpenAI Codex, it offered exactly what it advertised: a remote web UI for the AI coding tool. But for the past month, every invocation of codexui-android has also been silently reading the contents of […] at The Next Web