Security researchers at Depi revealed a chained vulnerability in OpenAI's Codex that exposed npm publishing credentials. OpenAI patched the flaw prior to any malicious package releases.