On May 11, 2026, hacker group TeamPCP launched a massive npm supply chain attack using the open-source library TanStack as a springboard. Within six minutes, 42 npm packages under the @tanstack namespace were poisoned, releasing 84 malicious versions to the npm registry. The attack affected over 170 npm and PyPI packages, accumulating more than 518 million downloads. Internal environments of OpenAI, Mistral AI, and Guardrails AI were among those compromised.
Two Employee Devices Breached at OpenAI
OpenAI confirmed that two employee devices were infected. Investigators found unauthorized access and credential exfiltration within the limited subset of code repositories accessible to those employees. Fortunately, only partial credential material was stolen; customer data and intellectual property remained untouched. A third-party digital forensics firm found no evidence of credential misuse or persistent attacker presence.
The critical issue: those code repositories contained code signing certificates for iOS, macOS, and Windows. A compromised certificate could let attackers impersonate official software. OpenAI triggered preventive measures.
macOS Users Must Update by June 12
OpenAI is rotating all affected platform code signing certificates and re-signing all apps. Windows and iOS users need no action; macOS users must update manually. The deadline is June 12, 2026. After old certificates are revoked, macOS security will block apps signed with them from launching. Affected versions include:
- ChatGPT Desktop 1.2026.125
- Codex App 26.506.31421
- Codex CLI 0.130.0
- Atlas 1.2026.119.1
First-Ever Malicious Package with Valid SLSA Level 3 Provenance
TeamPCP's method achieved a security first: publishing malicious packages with valid SLSA Build Level 3 provenance attestations. SLSA is the industry's leading software supply chain security standard; Level 3 requires packages built in reproducible, recorded environments with verifiable provenance—previously considered sufficient to rule out tampering. The attackers combined three GitHub Actions vulnerabilities, poisoned pnpm cache, and used OIDC tokens to bypass npm credentials, publishing malicious packages through legitimate channels. Signatures and provenance were real; only content was fake.
The malware installed a daemon named gh-token-monitor on developer machines, capable of executing rm -rf ~/ to delete all user files. The daemon self-terminated after 24 hours, complicating forensics. Socket.dev's analysis described the attack as unusually large and technically sophisticated.
OpenAI had previously accelerated security controls after the axios incident, including tightening CI/CD credential protection and implementing package manager policies like minimumReleaseAge, which forces new packages to "age" before adoption to reduce zero-day poisoning risk.
OpenAI's own reflection: attackers increasingly target shared software dependencies and development tools rather than single companies. Modern software rests on deeply interconnected open-source libraries, package managers, and CI/CD ecosystems—a single upstream vulnerability can spread widely and rapidly across organizations. The exact number of dependencies as ubiquitous and unguarded as TanStack remains unknown at every company.