
Security News
AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.
@openai/codex-sdk
Advanced tools
Bring the power of the best coding agent to your application.
npm install @openai/codex-sdk
Call startThread() and run() to start a thread with Codex.
import { Codex } from "@openai/codex-sdk";
const codex = new Codex();
const thread = codex.startThread();
const result = await thread.run("Diagnose the test failure and propose a fix");
console.log(result);
You can call run() again to continue the same thread.
const result = await thread.run("Implement the fix");
console.log(result);
The run() method completes when a thread turn is complete and the agent has produced the final response.
You can stream events while they are being produced by calling runStreamed() and iterating the returned generator.
const { events } = await thread.runStreamed("Diagnose the test failure and propose a fix");
for await (const event of events) {
console.log(event);
}
If you don't have the original Thread instance to continue the thread, you can resume by calling resumeThread() and providing the thread identifier.
const threadId = "...";
const thread = codex.resumeThread(threadId);
const result = await thread.run("Implement the fix");
console.log(result);
By default, Codex will run in the current working directory. You can change the working directory by passing the workingDirectory option when creating a thread.
const thread = codex.startThread({
workingDirectory: "/path/to/working/directory",
});
To avoid unrecoverable errors, Codex requires the working directory to be a Git repository. You can skip the Git repository check by passing the skipGitRepoCheck option when creating a thread.
const thread = codex.startThread({
skipGitRepoCheck: true,
});
FAQs
TypeScript SDK for Codex APIs.
The npm package @openai/codex-sdk receives a total of 136,611 weekly downloads. As such, @openai/codex-sdk popularity was classified as popular.
We found that @openai/codex-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.

Research
/Security News
Chrome extension CL Suite by @CLMasters neutralizes 2FA for Facebook and Meta Business accounts while exfiltrating Business Manager contact and analytics data.

Security News
After Matplotlib rejected an AI-written PR, the agent fired back with a blog post, igniting debate over AI contributions and maintainer burden.