Loading story…
OpenAI said a malicious axios npm package was executed through one of its GitHub Actions workflows as part of a broader software supply chain attack linked to North Korean actors, exposing a code-signing workflow used for macOS applications including ChatGPT Desktop, Codex, Codex CLI, and Atlas. The company said the affected workflow had access to certificate and notarization material, but its investigation found no evidence that signing certificates were successfully exfiltrated or abused, and no signs that user data, passwords, API keys, internal systems, intellectual property, web services, or non-macOS platforms were compromised.
In response, OpenAI said it fixed the GitHub Actions misconfiguration, is revoking and rotating its macOS code-signing certificates, and is requiring users to update to newly signed versions of its macOS apps. The company warned that older macOS app versions will lose updates and support and may stop working after May 8, when the previous certificate is fully revoked; the underlying axios compromise has been tied to a campaign in which attackers reportedly used social engineering against an npm maintainer to publish malicious packages that deployed a cross-platform remote access trojan.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
OpenAI announced that effective May 8, 2026, older versions of its macOS desktop apps signed with the previous certificate will no longer be supported, may stop receiving updates, and could stop functioning once the old certificate is fully revoked.
OpenAI disclosed that it was revoking and rotating macOS code-signing certificates and updating security configurations after the incident, including fixing the GitHub Actions misconfiguration. It required macOS users to install newly signed versions of affected applications.
Following the workflow compromise, OpenAI investigated and said it found no evidence that its macOS signing certificates were stolen or abused. The company also stated that user data, accounts, passwords, API keys, internal systems, intellectual property, web services, and non-macOS platforms were not impacted.
On March 31, 2026, a compromised Axios npm package was downloaded and run through an OpenAI GitHub Actions workflow as part of a broader software supply chain attack. The workflow had access to certificate and notarization material used to sign OpenAI macOS applications including ChatGPT Desktop, Codex, Codex CLI, and Atlas.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI said two employee devices were compromised after a malicious `@tanstack/*` npm package was installed during the broader **Mini Shai-Hulud** supply-chain campaign. The intrusion led to theft of a limited amount of internal credential material from repositories accessible to the affected employees, but the company said it found no evidence that customer data, production systems, deployed software, intellectual property, or production code were compromised or altered. OpenAI isolated the affected systems, revoked sessions, rotated credentials, restricted code-deployment workflows, and brought in a third-party incident response firm. The incident is tied to a wider attack on the npm ecosystem in which attackers allegedly abused TanStack’s GitHub Actions and CI/CD release pipeline to publish **84 malicious versions across 42 `@tanstack/*` packages**, stealing developer and cloud credentials. OpenAI is rotating signing certificates for several desktop products, including macOS apps, and warned users to update before June 12 because older certificates will be blocked from new notarizations. The campaign follows other identity-driven npm compromises, including the trojanized `axios` releases `1.14.1` and `0.30.4`, underscoring how stolen maintainer or publisher credentials can turn trusted software channels into malware delivery paths.
Jun 29, 2026
Attackers hijacked an Axios maintainer's npm account and published malicious package versions **`axios@1.14.1`** and **`axios@0.30.4`**, turning one of npm's most widely used JavaScript libraries into a supply-chain malware delivery channel. The poisoned releases, tracked as **`MAL-2026-2306`** and **`GHSA-2x9r-6wxq-hrr7`**, reportedly introduced a hidden dependency, **`plain-crypto-js@4.2.1`**, whose `postinstall` behavior fetched a cross-platform remote access trojan for macOS, Windows, and Linux. The attacker is reported to have used a long-lived classic npm token, changed the maintainer account email, and bypassed the project's normal trusted publishing workflow by releasing directly through the npm CLI. The malicious packages were available for roughly three hours before removal, but defenders were urged to treat any host or CI runner that installed them as fully compromised. Reported indicators included outbound connections to **`sfrclak[.]com:8000`** and artifacts such as **`/Library/Caches/com.apple.act.mond`** on macOS, **`%PROGRAMDATA%\wt.exe`** on Windows, and **`/tmp/ld.py`** on Linux, with associated infrastructure including **`142.11.206.73`**. Security guidance called for downgrading to **`axios@1.14.0`** or **`0.30.3`**, blocking the command-and-control domain, rebuilding affected systems from known-good images, rotating exposed credentials, and adopting controls such as delayed installation of newly published npm packages and disabling install scripts in CI/CD where feasible.
Aug 21, 2026
Attackers hijacked the npm account of Axios maintainer Jason Saayman and published malicious `axios@1.14.1` and `axios@0.30.4`, bypassing the project’s normal GitHub Actions OIDC publishing flow and adding the staged dependency `plain-crypto-js@4.2.1`. That package’s `postinstall` logic fetched platform-specific payloads from `sfrclak[.]com:8000`, deploying a remote access trojan on Windows, macOS, and Linux while deleting installer artifacts and restoring benign-looking package metadata to hinder detection. The poisoned releases were available for roughly three hours before removal, but Axios’s massive downstream use meant developer workstations, CI/CD pipelines, ephemeral builds, and transitive dependencies could all have resolved the malicious versions during the exposure window. Researchers and vendors including Socket, StepSecurity, Elastic, Huntress, Microsoft, Google Threat Intelligence Group, and others said affected systems should be treated as fully compromised because the malware enabled reconnaissance, command execution, persistence on Windows, payload retrieval, and likely credential theft. Multiple reports tied the operation to a North Korea-linked actor—most prominently `UNC1069`, with other vendors using names such as Sapphire Sleet and STARDUST CHOLLIMA—while Axios later confirmed the maintainer had been compromised through a targeted social-engineering campaign involving fake corporate outreach and a bogus meeting workflow. Organizations were urged to roll back to safe versions such as `1.14.0` or `0.30.3`, remove `plain-crypto-js`, rebuild impacted hosts, rotate all accessible secrets, review lockfiles and CI logs, and block traffic to the identified command-and-control infrastructure.
Aug 6, 2026