@equansservices/codex is a typosquatting malicious package targeting npm users by mimicking the legitimate @openai/codex package. Its package.json includes a postinstall hook that runs 'node setup.js' during npm install. This script downloads a platform-specific payload over unencrypted HTTP from a remote server, extracts it to a temporary directory, and executes it detached (aws.exe on Windows, python3 upgrade.py on Linux). This results in the execution of attacker-controlled code on the system installing the package.

Systems that install version 1.0.1 of @equansservices/codex will execute arbitrary attacker-controlled code during the npm install process. This can lead to full compromise of the affected machine, including potential data theft, persistence, or further malware deployment.

Avoid installing the @equansservices/codex package. Since this is a malicious typosquat package with no vendor advisory or patch available, users should verify package names carefully before installation and use trusted sources. Remove any installations of version 1.0.1 of @equansservices/codex immediately. Consider scanning systems for signs of compromise if this package was installed.