OpenAI open-sources Codex CLI; AWS ties NPM hacks to NK

OpenAI released an early version of the Codex Security CLI and published the project on npm and GitHub. The tool scans source code repositories for security issues, tracks findings across multiple runs to show whether problems reappear, verifies that fixes address detected issues, and is designed to integrate into CI/CD pipelines. OpenAI invited developer feedback while the tool remains under development.

Amazon’s Threat Intelligence team attributed recent compromises of several popular NPM packages to a group it tracks as Sapphire Sleet, which has links to North Korea. The incidents included manipulated or malicious updates to Axios, Debug and Chalk, along with a separate “typo-crypto” case. Amazon reported the actor focused on high-download packages to maximize downstream impact and used supply-chain techniques such as fragmenting payloads and deploying environment-aware malware that activates only under certain conditions. The advisory included indicators of compromise and urged maintainers and users to verify package integrity and review dependency chains.

Anthropic researchers using the Claude Mythos Preview reported two cryptanalytic developments. The team described an improved key-recovery attack that lowers the effective security level of HAWK, a post-quantum signature candidate, by about half. They also reported a faster meet-in-the-middle attack against a seven-round version of AES. Anthropic noted HAWK is still a candidate algorithm and the AES work targets a reduced-round variant; the researchers said there is no direct impact on currently deployed, full-strength systems.

The three items address different parts of software security. OpenAI’s CLI targets early detection and verification of code issues during development and before packages are published. Amazon’s attribution highlights active supply-chain compromises in widely used package ecosystems and describes techniques meant to extend reach and avoid detection. Anthropic’s results show AI-assisted methods being applied to evaluate cryptographic constructions and reduced-round cipher models.

Each organization outlined next steps. OpenAI requested community feedback as it continues development of the scanner. Amazon provided technical indicators and recommended that package maintainers and users validate packages and audit dependency trees. Anthropic called for continued analysis of post-quantum signature candidates and further review of the affected algorithms.

No evidence was reported that the cryptanalysis findings or the open-source scanner directly affect operational systems today; the NPM compromises were tied to active supply-chain abuse and prompted protective guidance for maintainers and users.