---
title: OpenAI Hit by TanStack Supply Chain Attack
description: "OpenAI's security breach: the TanStack attack hit two employee devices, with no evidence customer data was touched. Update macOS apps by June 12, 2026."
canonical_url: https://codekeeper.co/ticker/openai-tanstack-attack-device-infection
---

# OpenAI Hit by TanStack Supply Chain Attack

OpenAI's security breach: the TanStack attack hit two employee devices, with no evidence customer data was touched. Update macOS apps by June 12, 2026.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team May 15, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

OpenAI disclosed that two employee devices in its corporate environment were infected during the May 11 TanStack supply chain attack, attributed by researchers to TeamPCP. The attackers exploited weaknesses in package publishing to release 84 malicious artifacts across 42 packages, carrying Mini Shai-Hulud — a variant of the Shai-Hulud worm. Limited credential material was exfiltrated from a subset of internal source code repositories. OpenAI says it has found no evidence that user data, production systems or intellectual property were affected. It rotated all credentials across the impacted repositories and revoked user sessions. Those repositories also held code-signing certificates for OpenAI's iOS, macOS and Windows products, which have now been rotated and the apps re-signed. Only macOS users need to act: update ChatGPT Desktop, the Codex app, Codex CLI and Atlas by June 12, 2026, or macOS will start blocking the older builds. The 84 poisoned versions shipped with valid SLSA Build Level 3 provenance, so signed attestations were no defence. For OpenAI the timing was awkward — it was still hardening after a malicious Axios package reached it through a GitHub Actions workflow in late March. **Source:** [Security Week](https://www.securityweek.com/openai-hit-by-tanstack-supply-chain-attack/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopenai-tanstack-attack-device-infection%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks CISA's Three-Day Zimbra Patch Deadline Expires as Exploitation Spreads Aug 28, 2026](https://codekeeper.co/ticker/patch-critical-zimbra-vulnerability-prevent-exploitation)

[Nearly 33,000 NHS Patients Caught Up in 2024 Ransomware Attack Aug 12, 2026](https://codekeeper.co/ticker/bedfordshire-hospitals-data-breach-2024)

[Windows Netlogon RCE Reported Under Active Exploitation — Patch Now Aug 12, 2026](https://codekeeper.co/ticker/critical-netlogon-vulnerability-patch-immediately)

[Sheffield Hospitals Charity Supporters Hit in Beacon CRM Data Breach Aug 11, 2026](https://codekeeper.co/ticker/sheffield-hospitals-charity-data-breach-alert)