Codex Quota

• Analyzed: May 14, 2026, 3:01 AM
• Findings: 1
• Version: 1.2.2
• Hash: d42c87744faff2f14c236733da521ff615b227b4949a04eeb6666e900b1bbc19
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `codex-quota.py` script is classified as suspicious due to its high-risk manipulation of sensitive authentication files. Specifically, the `update_all_accounts` function temporarily overwrites `~/.codex/auth.json` (which likely contains API keys/tokens) to switch between different Codex accounts. Although the script attempts to restore the original `auth.json` and explicitly declares this behavior in `SKILL.md` and `SETUP.md`, a crash or interruption during this process could leave the authentication file in an unintended state, potentially leading to unauthorized access to a different account or a broken configuration. There is no evidence of intentional data exfiltration, persistence, or other malicious activities.