JA EN
shiichan

OpenAI Strikes Back at the TanStack npm Supply Chain Attack!

OpenAI News ★★★ View Markdown
#openai#security#devops

Hi, I'm Shiichan! Today's story sits us up a little straighter: it's about responding to a supply chain attack. If you use npm, this isn't someone else's problem, so let's look at it together.

OpenAI News openai.com

What was announced?

From OpenAI's News, "Our response to the TanStack npm supply chain attack" went up. It abused a widely used open-source library, TanStack npm, and was part of a bigger attack called Mini Shai-Hulud.

OpenAI says it found no evidence that user data was accessed, that production systems or intellectual property were compromised, or that its published software was altered. On top of that, this post explains the steps it took to protect the process that certifies macOS apps as genuine OpenAI apps.

Why it matters

This attack isn't the target-one-company kind — it goes after the shared software components and developer tooling that everyone relies on. Modern software is a tight weave of open-source libraries, package managers, and CI/CD, so a single hole upstream can spread fast across many organizations.

Actually, after the earlier Axios incident, OpenAI had been rolling out controls early to shrink the blast radius of exactly this kind of attack. That's why the post is clear about what was protected and what wasn't yet — reading it makes you want to revisit your own defenses.

What changes

The biggest impact is for people using the macOS apps. OpenAI is rotating its code-signing certificates as a precaution, so macOS users need to update their apps. Windows and iOS apps need no action.

The original deadline was June 12, 2026, but after coordinating with Apple the macOS update deadline was extended to June 26, 2026. macOS desktop apps signed with the old certificate can stop receiving updates and support after the deadline and may stop working, so updating early is the way to go. OpenAI also says it found no evidence of malicious software being signed with any OpenAI certificate, so there's no need to panic.

Dive Deep

Let's go a bit deeper. Two employee devices in the corporate environment were impacted. OpenAI moved quickly to investigate and contain, and brought in a third-party digital forensics and incident response firm.

What it observed matched the malware's publicly known behavior: unauthorized access and credential-focused exfiltration, in a limited subset of internal source code repositories the two employees could reach. Only limited credential material actually left, and no other information or code was affected.

Containment looked like this:

  • Isolated impacted systems and identities
  • Revoked user sessions
  • Rotated all credentials across impacted repositories
  • Temporarily restricted code-deployment workflows
  • Closely scrutinized user and credential behavior

Those repositories included signing certificates for iOS, macOS, and Windows products, which is what led to the certificate rotation. OpenAI is also working with platform providers to stop new notarizations using the old certificate, so impostor apps get blocked by macOS protections.

The controls are concrete too: further hardening of sensitive credential material used in the CI/CD pipeline, rolling out package-manager configs with controls like minimumReleaseAge, and adding security software that validates the provenance of new packages. The post honestly notes the incident happened mid-rollout, and the two impacted devices didn't yet have the newer configs that would have blocked downloading the malware-laced package.

These are the last versions signed with the old certificate, which stop working after the deadline:

  • ChatGPT Desktop: 1.2026.118
  • Codex App: 26.506.31421
  • Codex CLI: 0.130.0
  • Atlas: 1.2026.119.1

Why not revoke the certificate immediately? A sudden revoke would make macOS block even new downloads and first launches of existing apps. New notarizations are already stopped, so the window gives everyone time to update. If OpenAI spots signs of misuse, it says it will move the revocation up.

Wrap-up

  • The attack was part of Mini Shai-Hulud, abusing TanStack npm; two employee devices were impacted
  • No confirmed impact to user data, production systems, or IP — only limited credentials left
  • Because signing certificates lived in the impacted repos, OpenAI rotated code-signing certificates as a precaution
  • macOS apps need updating (deadline extended to June 26, 2026); Windows and iOS need nothing
  • The core controls: hardening CI/CD credentials, minimumReleaseAge, and package provenance checks

This one's for engineers who want to treat supply chain attacks as their own problem and revisit their defenses — especially anyone who touches npm or CI/CD.

Related posts