Curiously, I didn't find any reference in the Open source licences section of the codex app.
Is this a MPL 2.0 violation?
Despite the title, I'm not sure it's actually bundled. Some of the skills plugins will download it on the first run. So it depends where they are grabbing it from rather than the presence of the binary on the system, but I haven't checked that deep into where they actually grab it.
I think that depends on if they distribute it with the install package, or if they download it once installed.
Copyright violation is the last thing one could accuse ChatGPT of.