macOS moved official npm @openai/codex 0.120.0 binary to Trash; certificate revoked

Summary

On 2026-07-21 at 03:35:57 PDT, launching an npm-installed Codex CLI caused macOS to show:

Malware Blocked and Moved to Trash — “codex” was not opened because it contains malware.

The native Mach-O was moved out of the npm package, leaving the Node wrapper unable to spawn it (ENOENT). A separately installed current standalone CLI and the ChatGPT Desktop embedded Codex binary were unaffected.

Environment

• macOS 26.5.2 (25F84)
• Apple Silicon
• XProtect configuration version observed: 5351 (installation history shows it was installed before the event)
• Node: v24.6.0
• npm wrapper: @openai/codex@0.120.0
• native package: @openai/codex@0.120.0-darwin-arm64
• affected path shape:

~/.nvm/.../lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/codex/codex

Decisive artifact comparison

The quarantined file was inspected without executing, restoring, or uploading it:

• size: 152,799,424 bytes
• SHA-256: 5b40f730a9937e85ee13fd7112d33951a76f603797d5e8ab2905d2ed3cfa703f
• type: Mach-O 64-bit executable arm64
• codesign --verify --strict: passes
• signer: Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)
• hardened runtime: present
• trusted signing timestamp: 2026-04-10 19:15:54
• xattrs: com.apple.provenance; no com.apple.quarantine

I streamed the official npm registry tarball referenced by the package metadata and verified its published tarball integrity without saving or uploading the quarantined sample. The native binary inside the official tarball has the same size and SHA-256 shown above. This rules out local byte-level tampering of the affected binary.

However:

spctl --assess --type execute -vvv <affected-binary>
<affected-binary>: CSSMERR_TP_CERT_REVOKED

So this artifact is not unsigned. It is an official, OpenAI-signed npm artifact whose signing trust is currently rejected as certificate-revoked.

System log correlation

At the same timestamp that the npm native directory became empty:

• syspolicyd logged moveItemToTrashWithReply
• CoreServicesUIAgent logged that the item was moved to Trash
• CoreServicesUIAgent then logged an error copying quarantine properties, consistent with the absence of com.apple.quarantine

The item name and internal detection details were privacy-redacted as <private>, so I could not recover a malware-family/YARA rule name. The current Gatekeeper database did not contain a direct row matching this SHA-256, CDHash, or Team ID.

Expected behavior / request

An official byte-identical npm artifact should not produce a generic malware verdict and destructive removal without clear release guidance.

Please investigate:

1. whether the Developer ID certificate used for 0.120.0-darwin-arm64 was intentionally revoked;
2. which npm CLI versions are affected;
3. whether this event is certificate-revocation handling, an XProtect false positive, or both;
4. whether users should remove older global npm installations and use the current standalone distribution.

I did not restore or execute the removed file, bypass Gatekeeper, or upload the binary. After recording the hash, I permanently deleted the isolated sample and removed the redundant broken npm global installation.

Related reports: #31377, #23649, #32329.