Breaches and incidentsBriefReported by a reputable outlet, citing the company
OpenAI: two employee devices hit by the TanStack npm compromise, credential material and signing certificates exposed
OpenAI said two employees’ devices were impacted and it found unauthorized access to, and theft of “only limited credential material” from, a limited set...
- Disclosed
What happened
- OpenAI said two employees’ devices were impacted and it found unauthorized access to, and theft of “only limited credential material” from, a limited set of internal source code repositories those employees could reach. It found no evidence that user data, production systems or IP were accessed or that its software was altered.
- Root cause: the TanStack npm supply-chain compromise (May 2026; see the catalogue’s TanStack / Mini Shai-Hulud entry) ran on the employees’ machines.
- TechCrunch says it is unclear who is behind the TanStack attack; others link it to TeamPCP.
- The repositories held code-signing certificates; OpenAI rotated them as a precaution, which required macOS users to update the app.
Sources
- https://techcrunch.com/2026/05/14/openai-says-hackers-stole-some-data-after-latest-code-security-issue/
- https://securityaffairs.com/192222/hacking/openai-hit-by-supply-chain-attack-linked-to-malicious-tanstack-packages.html
- https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/,
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.