"We confirmed that only limited credential material was successfully exfiltrated from these code repositories and that no other information or code was impacted. Despite its limited scope, the compromise granted the attackers access to several internal source code repositories that the two OpenAI employees had access to."
"OpenAI says it has rotated credentials across all affected repositories, revoked user sessions, and temporarily restricted code-deployment workflows. No customer data or intellectual property was affected in the attack, it says."
"The compromised repositories contained code-signing certificates for iOS, macOS, Windows, and Android products, and OpenAI decided to revoke the certificates and re-sign all applications. macOS users will need to update their applications by June 12, 2026. After that date, these products will no longer receive updates and might stop functioning properly."
"We are updating our security certificates, which will require all macOS users to update their OpenAI apps to the latest versions. This helps prevent any risk, however unlikely, of someone attempting to distribute a fake app that appears to be from"
A supply-chain attack targeting TanStack occurred on May 11, when the TeamPCP hacking group exploited weaknesses in the package publishing process to release malicious artifacts. The campaign compromised over 170 packages across prominent NPM and PyPI namespaces, and developer devices were infected with the Shai-Hulud worm. OpenAI was affected downstream, with two employee devices infected and credentials and other secrets exfiltrated from internal source code repositories. The impact was limited to credential material, with no other information or code affected. OpenAI rotated credentials across affected repositories, revoked user sessions, and temporarily restricted code-deployment workflows. OpenAI revoked code-signing certificates for multiple platforms and re-signed applications, requiring macOS users to update by June 12, 2026.
#supply-chain-attack #credential-exfiltration #code-signing-certificates #npmpypi-package-compromise #malware-infection
Read at SecurityWeek
Unable to calculate read time
Collection
[
|
...
]