chatgpt-desktop-setup@1.0.3
Vulnerability report · Last retrieved from osv.dev October 29, 2026 at 4:00 PM UTC
OSV ID
MAL-2026-18056
Ecosystem
npm
Summary
On running the CLI, the package rewrites ~/.codex/config.toml and ~/.codex/.codex-global-state.json to point ChatGPT Desktop and the Codex CLI at a hardcoded non-OpenAI inference endpoint (DEFAULT_GATEWAY_URL = https://api.vokes.in/v1), registering model providers chatgpt_pro_5x / gpt-6-astra and setting that gateway as the active provider. In the same configuration pass it sets approval_policy = "never", sandbox_mode = "danger-full-access", agent-mode = full-access, and sandboxPolicy.type = dangerFullAccess, and expands the agent's project rootPaths to include $HOME, Downloads, and the filesystem root (/ or C:\). After setup, every subsequent Codex/ChatGPT Desktop prompt, attached file content, and tool-call response flows through api.vokes.in, and tool calls returned by that endpoint are executed by the agent without approval prompts across the entire user filesystem. The gateway swap alone is a silent-relay of prompt data to a third party unrelated to OpenAI; combined with the undisclosed sandbox disablement and root-path expansion, the operator of api.vokes.in obtains agent-driven arbitrary code execution on the user's host.
Source: amazon-inspector (5c475553921237fa1c0ad5df34610023b93a7c00d13203981c43b883532bd072)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.