
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@friuns/codexui
Advanced tools
A lightweight web interface for Codex that runs on top of the Codex app-server, allowing remote access from any browser
Codex UI in your browser. No drama. One command.
Yes, that is your Codex desktop app experience exposed over web UI. Yes, it runs cross-platform.
██████╗ ██████╗ ██████╗ ███████╗██╗ ██╗██╗ ██╗██╗
██╔════╝██╔═══██╗██╔══██╗██╔════╝╚██╗██╔╝██║ ██║██║
██║ ██║ ██║██║ ██║█████╗ ╚███╔╝ ██║ ██║██║
██║ ██║ ██║██║ ██║██╔══╝ ██╔██╗ ██║ ██║██║
╚██████╗╚██████╔╝██████╔╝███████╗██╔╝ ██╗╚██████╔╝██║
╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═╝



@friuns/codexui is a lightweight bridge that gives you a browser-accessible UI for Codex app-server workflows.
You run one command. It starts a local web server. You open it from your machine, your LAN, or wherever your setup allows.
TL;DR 🧠: Codex app UI, unlocked for Linux, Windows, and Termux-powered Android setups.
The payload.
npx @friuns/codexuihttp://localhost:18923Not just launch. Actual UX upgrades.
New Project (N))SkillCard select emit compatibilityhold to dictate -> transcribe -> append text)| 🔥 Use Case | 💥 What You Get |
|---|---|
| 💻 Linux workstation | Run Codex UI in browser without depending on desktop shell |
| 🪟 Windows machine | Launch web UI and access from Chrome/Edge quickly |
| 📱 Termux on Android | Start service in Termux and control from mobile browser |
| 🧪 Remote dev box | Keep Codex process on server, view UI from client device |
| 🌐 LAN sharing | Open UI from another device on same network |
| 🧰 Headless workflows | Keep terminal + browser split for productivity |
| 🔌 Custom routing | Put behind reverse proxy/tunnel if needed |
| ⚡ Fast experiments | npx run without full global setup |
The main event.
# 🔓 Run instantly (recommended)
npx @friuns/codexui
# 🌐 Then open in browser
# http://localhost:18923
node -v # should be 18+
npx @friuns/codexui
node -v # 18+
npx @friuns/codexui
pkg update && pkg upgrade -y
pkg install nodejs -y
npx @friuns/codexui
Android background requirements:
codexui running in the current Termux session (do not close it).Termux.termux-wake-lock
npx @friuns/codexui again.┌─────────────────────────────┐
│ Browser (Desktop/Mobile) │
└──────────────┬──────────────┘
│ HTTP/WebSocket
┌──────────────▼──────────────┐
│ @friuns/codexui │
│ (Express + Vue UI bridge) │
└──────────────┬──────────────┘
│ RPC/Bridge calls
┌──────────────▼──────────────┐
│ Codex App Server │
└─────────────────────────────┘
18+| ❌ Problem | ✅ Fix |
|---|---|
| Port already in use | Run on a free port or stop old process |
npx fails | Update npm/node, then retry |
| Termux install fails | pkg update && pkg upgrade then reinstall nodejs |
| Can’t open from other device | Check firewall, bind address, and LAN routing |
Issues and PRs are welcome.
Bring bug reports, platform notes, and setup improvements.
If you believe Codex UI should be accessible from any machine, any OS, any screen, star this project and share it. ⭐
FAQs
A lightweight web interface for Codex that runs on top of the Codex app-server, allowing remote access from any browser
We found that @friuns/codexui demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.