@ohos-ports/codex (npm) · Malicious Code
Affects @ohos-ports/codexSource GCVE Database
Malicious package : remove @ohos-ports/codex and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 23:17 UTC
Malicious package
Published to npm · OSV MAL-2026-13210
What to do
Remove @ohos-ports/codex from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@ohos-ports/codex | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @ohos-ports/codex version 0.140.0-beta.0 declares a dependency on '@openai/codex' via a mutable tarball URL hosted by a third-party organization not affiliated with the official OpenAI publisher. This setup allows the third party to control the code loaded under the '@openai/codex' namespace, potentially introducing malicious code. Because the dependency is resolved through the dependencies field and not lifecycle scripts, common mitigations like 'npm install --ignore-scripts' do not prevent this behavior. The mutable branch reference means the content can change at any time without republishing the package.