The npm package codex-setup versions 1.0.0 through 1.0.3 is identified as malicious software. Installation or execution of this package may lead to full compromise of the affected computer, requiring immediate secret and key rotation from a separate device. Despite one source indicating no suspicious behavior was detected in version 1.0.1, another authoritative source strongly warns that any system with this package should be considered fully compromised.