codex-security

You probably want @openai/codex-security.

npx @openai/codex-security

This unscoped package is an empty placeholder. It has no functionality and is not affiliated with OpenAI.

The official Codex Security CLI installs its command as codex-security, so the unscoped name is the one people type by mistake. npx runs a name it cannot resolve locally by fetching it from the registry and executing it immediately — which makes an unclaimed lookalike name a way to get code onto other people's machines. Holding the name removes that opportunity.

The irony is the point. A security tool shipped a command name whose unscoped twin was left unregistered, so the obvious way to invoke it led users into precisely the supply-chain failure the tool is built to detect. A release that audits dependency risk is the last one that should leave its own install path open.

Running it prints a notice and exits with status 1, so it cannot silently pass as a successful step in a script. Change the final process.exit(1) in bin/cli.js to process.exit(0) if you want the opposite.

Publishing

npm login
npm publish --access public

License

MIT