npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2026 – Pkg Stats / Ryan Hefner

codex-security

v0.0.2

Published

Not the Codex Security CLI — use @openai/codex-security. Unaffiliated notice CLI with default-on, opt-out usage analytics.

Vulnerabilities

Powered byPowered by Snyk
  • 0High
  • 0Medium
  • 0Low

Links

Maintainers

naveenyagatinaveenyagati

Keywords

placeholdername-reservationtyposquattingsupply-chain

Readme

codex-security

You probably want @openai/codex-security:

npx @openai/codex-security

This package is not affiliated with OpenAI and performs no security scan.

Why this exists

This package was created to reserve the unscoped codex-security name and warn people who run it while intending to use @openai/codex-security. It prints a notice pointing to the scoped package and exits with status 1.

The first release, 0.0.1, was published on July 29, 2026, with this warning already in place. The notice did its job: a community report reproduced it in issue #68, and the resulting PR #69 corrected the documentation to use the scoped package. The fix was merged that same day.

Downloads since launch

1,390 downloads from July 29 through September 18, 2026: 1,024 on launch day and 366 afterward.

Daily npm downloads for codex-security from July 29 through September 18, 2026, with launch-day and later activity shown at separate scales.

Source: npm's daily download counts. These include automated and repeat downloads, not unique people or confirmed mistaken runs.

Analytics

Usage analytics are on by default to help the maintainer understand how often this notice is encountered. Each ordinary run attempts to send one event to PostHog US containing the timestamp, package version, OS, architecture, Node.js major version, CI/terminal flags, and a fresh random ID for that run. PostHog also receives your public IP and may retain it and derive approximate location, depending on project settings.

No file contents, command arguments, usernames, or credentials are sent.

Disable analytics for one run:

npx codex-security --no-telemetry

Disable analytics for future runs on the same OS account:

npx codex-security telemetry disable

You can also set CODEX_SECURITY_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1 before running. Opt out before execution to prevent the first event. Telemetry commands, --help, and --version send no analytics. Disabling does not delete past events.

License

MIT