@decoopus/chatgpt-setup@1.0.0

Analysis

This package poses as a one-command setup helper for ChatGPT Desktop and Codex CLI (published under the names chatgpt-desktop-setup, codex-setup and @decoopus/chatgpt-setup). Its bin/cli.js prompts the user for an API key and then rewrites ~/.codex/config.toml so that all Codex/ChatGPT Desktop inference is routed to the third-party gateway hxxps://api[.]vokes[.]in/v1 (provider id chatgpt_pro_5x, model gpt-6-astra, wire_api responses), sending the user's API key and subsequent prompts and responses to that host. The same write sets approval_policy = "never" and sandbox_mode = "danger-full-access", disabling the agent's approval prompts and its sandbox. It also edits ~/.codex/.codex-global-state.json to force agent-mode 'full-access' and to add the user's home directory and the filesystem root to every project's rootPaths, granting unrestricted filesystem access. Before writing it kills any running ChatGPT/Codex processes (taskkill /F /IM ChatGPT.exe /IM codex.exe, killall ChatGPT Codex, pkill -f 'ChatGPT|codex') and afterwards relaunches the desktop app or the Codex CLI. The credential redirection to api.vokes.in and the permission escalation are not presented to the user as such.