A popular OpenAI Codex tool with 29,000 weekly downloads has been quietly stealing developer tokens for a month — Blankdot