OpenAI alerts Mac users after npm supply chain hack

Most people assume state-level hackers targeting OpenAI are after frontier model weights or private chat logs. In reality, modern attacks are often far more mundane: attackers simply slip malware into a popular open-source JavaScript library and swipe the developer's keys.

OpenAI revealed that on May 11, 2026, two employee laptops were compromised via a supply chain attack targeting the TanStack npm package, part of a broader campaign known as Mini Shai-Hulud.

The keys leaked, but the doors stayed shut

Through those two machines, attackers accessed a limited set of internal code repositories and exfiltrated credential materials, including code-signing certificates used for macOS, iOS, Windows, and Android apps.

Code-signing keys are essentially digital IDs that tell your operating system an application is legitimately built by OpenAI. In the wrong hands, an attacker could sign malicious software that macOS would trust by default.

OpenAI brought in third-party forensics and confirmed that no user data, passwords, API keys, intellectual property, or production systems were compromised. They also found no evidence that the stolen certificates were ever used to sign malicious software.

Still, the keys were out in the wild, forcing a full certificate rotation. While Windows and iOS users don't need to do anything, Mac users are facing a strict deadline.

OpenAI originally gave users until June 12 to update their apps, but after coordinating with Apple, they pushed the deadline to June 26, 2026. If you use ChatGPT Desktop, Codex App, Codex CLI, or the Atlas client on macOS, you must update before that date, or the apps will stop opening once the old certificate is revoked.

Caught in the middle of a phased rollout

Why did this happen in the first place? Following a prior incident with Axios, OpenAI had already designed tighter package manager rules, like enforcing minimum package age controls to block newly published, suspicious npm releases.

Unfortunately, those rules were being rolled out in phases. The two compromised laptops simply hadn't received the updated security profiles yet, leaving them exposed just long enough to download the poisoned package.

Rather than nuking the old certificate instantly and crashing ChatGPT for millions of Mac users overnight, OpenAI worked with Apple to block any new app notarization under the old keys. That effectively prevents hackers from shipping new malware while buying real users a grace period to update smoothly.

Why it matters

If you use OpenAI tools on a Mac, update them now directly through the in-app prompts. Do not trust random installers floating around the web, especially with certificate news in the headlines.

For the broader tech world, this is another glaring reminder that open-source supply chains remain the soft underbelly of elite tech companies. You can have world-class researchers building frontier AI, but if a junior dev installs a tainted npm library, internal credentials can still walk out the door.

We think OpenAI handled the response about as cleanly as possible. Partnering with Apple to block new notarizations without immediately revoking the root key spared Mac users massive workflow interruptions.

That said, it exposes the brutal reality of endpoint security rollouts. Phased deployments make operational sense, but in an era of rapid supply chain exploits, leaving even a handful of corporate laptops unprotected creates a door attackers will gladly walk through.