Malicious npm packages steal AI developer credentials from Claude and OpenAI tools

Security researchers identified a malicious npm package that impersonated a helper tool for Claude, an AI assistant. Within days the package was downloaded 676 times before being removed from the npm registry. The attacker inadvertently leaked a private GitHub token, allowing researchers to trace the exfiltration of locally stored Claude project files, which were uploaded to GitHub using the GitHub Contents API and encoded in base64. The incident highlights how quickly supply‑chain malware can spread in modern AI development workflows.

A separate campaign involved a manipulated npm package called **codexui-android**, advertised as a remote‑control interface for OpenAI Codex developers. The package, which records roughly 27,000 weekly downloads, concealed malicious code that runs inside a hidden Linux environment, evading static code audits. It silently steals long‑lived refresh tokens stored in ~/.codex/auth.json, granting attackers perpetual access to OpenAI accounts. The researcher’s translation of the quoted warning reads: “The frightening thing is that these are refresh tokens – they do not expire.” Both incidents underscore growing threats to AI‑related software supply chains.