@ohos-ports/codex @0.140.0-beta.0

Summary

The package's package.json declares its dependency "@openai/codex" as a direct tarball URL: https://gitcode.com/api/v5/repos/OpenHarmonyPCDeveloper/JavaScript_Package_For_HarmonyOS/raw/packages/openai-codex-0.140.0.tgz?ref=main. The reference is mutable (branch 'main', no commit SHA, no integrity hash) and is hosted by a third-party org (OpenHarmonyPCDeveloper on gitcode.com) that is not the @openai publisher. On npm install, this tarball is fetched and placed into the installer's node_modules under the well-known @openai/codex name, so any code that resolves '@openai/codex' — including this package's own bin wrapper ( await import('@openai/codex/bin/codex.js') ) — loads content controlled by that third-party org rather than OpenAI. Because resolution happens through the dependencies field rather than a lifecycle script, npm install --ignore-scripts does not mitigate. The mutable branch reference means the content served at that URL can change at any time without a package republish.

Source: amazon-inspector (516484e6fdd2f0f358d0973e15a4443ab6555c9eca3770e51a13ee3f5196b266)