{"data":{"id":"e89bf3cc-6d68-4c91-8087-453dcee60fc0","title":"Our response to the TanStack npm supply chain attack","summary":"OpenAI reports that two employee devices were affected by the Mini Shai-Hulud attack, which used a compromised TanStack npm package. The company says the activity led to limited credential exfiltration from a subset of internal source code repositories, and it found no evidence of customer data access, intellectual property compromise, or altered software.","solution":"OpenAI says it isolated impacted systems and identities, revoked user sessions, rotated all credentials across impacted repositories, and temporarily restricted code-deployment workflows. It is rotating code-signing certificates as a precaution, is stopping new notarizations with the previous certificates, and will fully revoke the certificate on June 12, 2026, after which macOS will block new downloads and launches of apps signed with it. macOS users will need to update their applications. The company also cites package manager configurations with minimumReleaseAge and additional provenance validation tools as controls it deployed, noting the two affected devices lacked them.","labels":["security","industry"],"sourceUrl":"https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack","publishedAt":"2026-05-13T00:00:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"low","attackType":["supply_chain"],"issueType":"incident","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["OpenAI","ChatGPT","Codex"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-05-13T00:00:00.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}