OpenAI Response to TanStack npm Supply Chain Attack

TL;DR

OpenAI has responded to a security incident involving the TanStack npm library, part of a broader "Mini Shai-Hulud" supply chain attack. While no user data or production systems were compromised, the company is rotating code-signing certificates for all platforms to prevent potential misuse of exfiltrated credentials.

Incident Overview and Impact

OpenAI identified that two employee devices in its corporate environment were impacted by malware delivered via the TanStack npm library. This attack was part of a larger ecosystem-level campaign known as Mini Shai-Hulud.

Scope of Compromise

• Employee Devices: Two devices were affected.
• Internal Repositories: The malware performed unauthorized access and credential-focused exfiltration from a limited subset of internal source code repositories accessible to the impacted employees.
• Exfiltrated Data: Only limited credential material was successfully exfiltrated; no intellectual property or other sensitive information was impacted.
• User Data: OpenAI found no evidence that user data, production systems, or intellectual property were compromised.

Remediation and Security Response

OpenAI engaged a third-party digital forensics and incident response firm to contain the activity and secure its systems.

Immediate Containment Actions

• System Isolation: Impacted systems and identities were isolated.
• Session Management: User sessions were revoked and credentials across impacted repositories were rotated.
• Credential Hardening: Code-deployment workflows were temporarily restricted and credential behavior was scrutinized.

Certificate Rotation and Platform Impact

Because the impacted repositories included signing certificates for iOS, macOS, Windows, and Android, OpenAI is rotating all code-signing certificates as a precaution.

• macOS Users: Must update their applications by June 26, 2026 (extended from June 12). After the revocation of the previous certificate, older versions of macOS apps will be blocked by macOS security protections and may cease to function.
• Windows and iOS Users: No action is required.
• Notarization: OpenAI is coordinating with platform providers to block new notarizations using the previous certificates to prevent unauthorized software signing.

Affected macOS Versions

Users must update versions beyond the following to maintain functionality:

• ChatGPT Desktop: 1.2026.118
• Codex App: 26.506.31421
• Codex CLI: 0.130.0
• Atlas: 1.2026.119.1

Long-term Security Enhancements

This incident occurred during a phased rollout of new security controls designed to mitigate supply chain attacks. The impacted devices lacked the updated configurations that would have prevented the malware download.

New Security Controls

Following a previous Axios incident, OpenAI has accelerated the deployment of the following:

• CI/CD Hardening: Increased protection for sensitive credential materials within the pipeline.
• Package Manager Controls: Implementation of configurations such as minimumReleaseAge to prevent the immediate adoption of newly published malicious packages.
• Package Provenance: Deployment of additional security software to validate the provenance of third-party components.

Conclusion on Ecosystem Risk

OpenAI notes that the current threat landscape has shifted toward targeting shared software dependencies and development tooling. Because modern software relies on an interconnected ecosystem of open-source libraries and package managers, vulnerabilities introduced upstream can propagate rapidly across organizations.