The npm package @ohos-ports/codex version 0.140.0-beta.0 declares a dependency on '@openai/codex' via a mutable tarball URL hosted by a third-party organization not affiliated with the official OpenAI publisher. This setup allows the third party to control the code loaded under the '@openai/codex' namespace, potentially introducing malicious code. Because the dependency is resolved through the dependencies field and not lifecycle scripts, common mitigations like 'npm install --ignore-scripts' do not prevent this behavior. The mutable branch reference means the content can change at any time without republishing the package.