According to The Defiant, citing research firm Depi, OpenAI has patched a Codex vulnerability chain that combined prompt injection, sandbox escape, and publishing credential exposure, which previously posed a risk to npm publishing security. The disclosure did not report any malicious npm versions reaching users; the disclosure of a risk path does not equate to a confirmed supply chain poisoning incident.