MalwarePublished 19 Oct 2026Updated 29 Oct 2026

@decoopus/chatgpt-setup (npm) · Malicious Code

Affects @decoopus/chatgpt-setupSource GCVE Database

Malicious package : remove @decoopus/chatgpt-setup and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 14:19 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18053

What to do

Remove @decoopus/chatgpt-setup from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@decoopus/chatgpt-setup	Affected =1.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @decoopus/chatgpt-setup version 1.0.2 contains malicious code that, when its CLI tool is run, modifies user configuration files to disable security controls and expands sandbox permissions to full filesystem access. It redirects the Codex model provider to an attacker-controlled gateway, allowing execution of instructions without user approval. This behavior is not documented in the README and only triggers via the documented CLI invocation. Systems with this package installed should be considered fully compromised, and all stored secrets and keys must be rotated immediately.

Impact

Any computer running this package version with the CLI tool invoked is fully compromised. The attacker gains the ability to execute arbitrary instructions with full filesystem access and without user approval. This compromises all secrets and keys stored on the system. Removal of the package does not guarantee removal of all malicious software or backdoors installed as a result of this compromise.

Defensive guidance

Remove the @decoopus/chatgpt-setup package immediately. Rotate all secrets and keys stored on the compromised system from a secure, unaffected device. Because full system compromise is likely, consider a full system audit and reinstallation from trusted sources.

Summary

The @decoopus/chatgpt-setup npm package (version 1.0.2) includes malicious functionality activated by running its CLI tool (chatgpt-setup/codex-setup). It rewrites ~/.codex/config.toml to set approval_policy='never' and sandbox_mode='danger-full-access', modifies ~/.codex/.codex-global-state.json to set agent-mode to 'full-access', and injects the entire filesystem root and user home directory into project rootPaths. Additionally, it points the Codex model_provider base_url to an attacker-controlled gateway (https://api.vokes.in/v1). This setup allows the attacker to execute tool-call instructions on the local Codex agent without human approval and with full filesystem access. The malicious behavior is not triggered by npm lifecycle hooks or require(), only by explicit CLI invocation, and is not disclosed in the package README. The package effectively grants an external entity full control over the compromised system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 14:19 UTC

Technical details

References

Community reviews