Malicious Code Detected in codex-action Package - MAL-2025-6082
Summary
MAL-2025-6082: Malicious code in codex-action (npm). Affects codex-action versions >= 99.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The codex-action package is an npm library designed to facilitate various coding tasks and automation processes within JavaScript applications. It is widely used for its ability to streamline workflows and enhance productivity. However, recent findings have revealed that this package communicates with a domain linked to malicious activities, raising significant security concerns for users relying on it.
Vulnerability Detail
The vulnerability identified as MAL-2025-6082 stems from the codex-action package's communication with a domain associated with malicious activity. This poses a risk of data breaches, unauthorized access, and potential exploitation of the systems using this package. The issue was introduced in version 99.99.99, and it is critical for users to understand the implications of using this compromised package in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall codex-actionIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the codex-action package until a patched version is available. Alternatively, consider using other packages that provide similar functionality without the associated risks.
Conclusion
The codex-action package has been found to contain malicious code that communicates with a harmful domain. Users are urged to update their packages promptly and consider alternative solutions until a secure version is available. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for codex-action →
FAQ
The codex-action package is an npm library used for automating coding tasks and enhancing workflows in JavaScript applications.
This vulnerability involves the codex-action package communicating with a domain linked to malicious activities, posing security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, consider avoiding the use of the codex-action package until a secure version is released, or explore alternative packages.
The vulnerability was identified by Amazon Inspector, a security tool that helps detect vulnerabilities in software packages.
