GoKawiilOpenAI says two employees' devices were breached in the recent TanStack supply chain attack that impacted hundreds of npm and PyPI packages, causing the company to rotate code-signing certificates for its applications as a precaution.
In a security advisory published today, the company said the incident did not impact customer data, production systems, intellectual property, or deployed software.
The company says the breach is linked to the recent "Mini Shai-Hulud" supply-chain campaign by the TeamPCP extortion gang, which targeted developers by slipping malicious updates into trusted and popular software packages.
"We observed activity consistent with the malware's publicly described behavior, including unauthorized access and credential-focused exfiltration activity, in a limited subset of internal source code repositories to which the two impacted employees had access," OpenAI explained.
The company says that only limited credentials were stolen from the repositories in the attack and that there is no evidence they were used in additional attacks.
OpenAI says it isolated affected systems and accounts, revoked sessions, rotated credentials across affected repositories, and temporarily restricted deployment workflows. The company also conducted a forensic investigation with the help of a third-party incident response firm.
Code signing certificates used for OpenAI products on macOS, Windows, iOS, and Android were also exposed in the incident. While OpenAI has not detected that these certificates were abused to sign malicious software, the company is rotating them as a precaution.
This rotation will require macOS users to update their OpenAI desktop applications before June 12, 2026, as applications signed with the older certificates may not launch or receive updates due to Apple's notarization process.
Windows and iOS users are not impacted and do not need to take any action.
The TanStack supply chain attack
... continue reading