Do Codex CLI have any transitive NPM dependencies that are maintained by Vercel?

[vhbui02]

Regarding the latest Vercel April 2026 security incident report, there is a high chance that some Vercel-maintained NPM packages have been hit with supply chain attacks. I want to ask if Codex CLI depends on any of them.

[etraut-openai]

The Codex CLI source code is open source. If you have questions about it, feel free to clone the repo and ask Codex questions about the source base.

[vhbui02]

If you have questions about it, feel free to clone the repo and ask Codex questions about the source base.

Yeah about that, I don't fully trust LLM when it comes to niche security aspect. You're an official OpenAI employee and also an active maintainer right? Sure you know which dependencies are being used here.