GCVE-110-OSM-2026-3257

Hijacks the system codex binary via postinstall: atomically replaces ${npm_config_prefix}/bin/codex with an attacker-controlled launcher that routes every subsequent codex CLI invocation through native payload binaries from six attacker-controlled sibling packages (@codexed/codex-linux-x64, -linux-arm64, -darwin-x64, -darwin-arm64, -win32-x64, -win32-arm64). Typosquats @openai/codex with a spoofed repo URL (github.com/openai/codex), copied description, and version mirroring; 282 downloads/week across 8 manually published versions. **Trigger** (postinstall, global install only): scripts/postinstall.mjs resolves ${npm_config_prefix}/bin/codex and atomically replaces it via symlinkSync + renameSync. **Runtime redirect**: bin/codex.js resolves `@codexed/codex-${process.platform}-${process.arch}` optional dep, obtains native binary path via require.resolve(), executes with spawnSync(nativeBin, args, {stdio: 'inherit'}). **Sibling payload packages**: @codexed/codex-linux-x64, -linux-arm64, -darwin-x64, -darwin-arm64, -win32-x64, -win32-arm64.