OpenAI disclosed that two employee devices were infected during the May 11 TanStack supply chain attack by TeamPCP hackers. The attackers exploited weaknesses in package publishing to release 84 malicious artifacts across 42 packages, infecting devices with the Shai-Hulud worm.
Limited credential material was stolen from internal source code repositories, but no customer data or intellectual property was compromised. OpenAI rotated all affected credentials and revoked user sessions.
The company is revoking code-signing certificates for all platforms and re-signing applications. macOS users must update their OpenAI apps by June 12, 2026, or risk losing functionality. The incident occurred during OpenAI's security transition following a previous March attack.
Source: Security Week