⚠️ OpenAI Caught in TanStack npm Supply Chain Attack — Credentials Stolen From Employee Devices

OpenAI confirmed this week that attackers stole internal credentials from two employee devices after poisoned npm packages from the TanStack supply chain compromise reached their machines. The company is now rotating signing certificates for multiple products and requiring users to update by June 12.

Here's a question we don't often ask about one of the most security-conscious companies on the planet: how did attackers get inside OpenAI's network? The answer, it turns out, is the same way they get into everyone else's — through a software supply chain. Malicious packages published to the npm registry — the same open-source repository millions of developers use every day — carried credential-stealing code onto machines at one of the world's most valuable AI companies.

OpenAI disclosed this week that it had been caught up in the wider "Mini Shai-Hulud" campaign — a sprawling supply chain operation that has spent weeks worming through npm ecosystems, CI/CD infrastructure, and GitHub Actions workflows. The company said there's no evidence that customer data, production systems, or deployed software were compromised. But two employee devices were hit, and attackers walked away with "limited credential material" from internal code repositories.

The incident ties OpenAI to an increasingly messy supply chain campaign that security firm Socket first connected to the TanStack compromise. Researchers say 84 malicious package versions spanning 42 @tanstack/* packages were published after attackers compromised parts of TanStack's release infrastructure. The poisoned packages were designed specifically to steal credentials — GitHub tokens, cloud secrets, npm credentials, and CI/CD authentication material.

OpenAI said the incident happened during a phased rollout of new supply chain security controls — put in place after a previous Axios-related incident. The two compromised employee devices simply hadn't yet received the updated package management protections that would have blocked the malicious dependency. In other words, a company actively hardening its defenses was bitten by a timing gap in its own rollout.

What the Attackers Actually Got

According to OpenAI's disclosure, the attackers carried out "credential-focused exfiltration activity" against a limited set of internal repositories reachable from the affected employee machines. The company said "only limited credential material was successfully exfiltrated from these code repositories."

That phrasing matters. "Limited" is a relative term — and in the context of credential security, any exfiltrated credential is one credential too many. Those stolen credentials were apparently enough to trigger a precautionary reset across multiple OpenAI products. The company is now rotating the certificates used to sign macOS versions of ChatGPT Desktop, Codex App, Codex CLI, and Atlas. Users of those products are required to update by June 12.

Who Is Behind the Attack?

Researchers tracking the wider Mini Shai-Hulud campaign have connected the activity to a threat group known as TeamPCP. This group appears to have developed an unhealthy interest in poisoning npm ecosystems and rifling through developer credentials. The same campaign has been linked to earlier attacks involving SAP-related npm packages, suggesting the same credential-stealing operation is spreading across multiple developer ecosystems.

Security firm Checkmarx has also been tracking another TeamPCP intrusion targeting Jenkins plugins, indicating this group is methodically working through the software development toolchain — first the build infrastructure, now the package registries, and likely the CI/CD pipeline next.

Why This Matters for Your Password Security

This story might sound like a niche developer infrastructure issue. But the method — credential theft via supply chain poisoning — is the same technique that has driven the broader surge in credential breaches we track at BestPasswordGenerator.org. Let's connect the dots.

Supply chain attacks work because trust is transitive. You trust npm packages to not steal your credentials. Your developers trust their package manager to download safe code. Attackers exploit that trust by inserting malicious code into packages from legitimate-seeming sources — often by stealing the publisher's own credentials first. It's credential stuffing and credential theft at the infrastructure level, and it's getting worse.

How Supply Chain Credential Theft Works

There are three main ways attackers steal credentials through software supply chains, and the TanStack campaign hit all three:

1. Poisoned dependencies: Attackers compromise a legitimate package publisher's credentials, then push malicious package versions. Developers who install or update that package automatically download the malware. In the TanStack case, attackers published 84 malicious versions across 42 packages — any developer running npm update or npm install on a project using TanStack could have been affected.
2. Stolen CI/CD credentials: Once the malware runs, it looks for environment variables, GitHub tokens, and CI/CD secrets stored on the developer's machine. These tokens give attackers access to internal code repositories, cloud infrastructure, and deployment pipelines — exactly what happened at OpenAI.
3. Lateral credential harvesting: With access to internal repositories, attackers search for hardcoded passwords, API keys, and cloud service credentials stored in code. They can also plant backdoors in internal packages to maintain access long after the initial infection is cleaned up.

OpenAI's Response: Certificate Rotation and User Updates

OpenAI responded by rotating signing certificates for the macOS versions of ChatGPT Desktop, Codex App, Codex CLI, and Atlas. The company is requiring users of those products to update by June 12 to ensure they're running versions signed with the new certificates.

The company said it's continuing to investigate the incident and monitoring for any downstream abuse tied to the stolen credentials. OpenAI also stated that no production systems were breached — a critically important distinction — but the less reassuring news is that attackers keep getting deeper into the software assembly line before anybody notices.

What You Can Do to Protect Against Supply Chain Credential Theft

While you can't control what happens inside OpenAI's network, the same credential-stealing tactics apply to anyone who manages credentials — which is everyone with an online presence. Here's a practical checklist:

1. Never Store Credentials in Code

Hardcoded passwords, API keys, and tokens in source code are the single most common credential theft vector in supply chain attacks. Use environment variables, secret managers (like HashiCorp Vault or AWS Secrets Manager), or a dedicated password manager instead. Our free password generator creates credentials strong enough for any system, but storing them safely is just as important as making them strong.

2. Use a Dedicated Password Manager

If you're a developer, use a password manager that integrates with your development workflow — 1Password and Bitwarden both have CLI tools that can inject credentials into terminal sessions without ever writing them to disk. See our review of the best password managers in 2026 for what we found in testing.

3. Enable MFA on Code Repositories

Multi-factor authentication isn't just for social media. Every major code hosting platform — GitHub, GitLab, Bitbucket — supports FIDO2 security keys and authenticator apps. Enable them. The attackers behind the TanStack campaign specifically target GitHub tokens and CI/CD credentials. Hardware security keys remain the strongest defense against credential theft.

4. Monitor Third-Party Dependencies

If you're a developer, use dependency scanning tools like Socket, Dependabot (GitHub), or Snyk to detect malicious packages before they reach your development environment. The 84 malicious TanStack packages were designed to evade detection — but automated scanning tools can detect known malicious patterns, unexpected outbound connections, and obfuscated code.

5. Rotate Tokens and Keys Regularly

OpenAI's response — rotating signing certificates after a confirmed breach — is exactly right. The same principle applies at every level. Rotate GitHub personal access tokens, cloud provider API keys, and database credentials on a regular schedule. If you can't remember when you last changed a credential, it's overdue.

The Bigger Picture: Supply Chain Attacks Are the New Normal

The TanStack campaign is part of a broader trend that's reshaping how we think about credential security. The 149 million credentials exposed in an unsecured database earlier this year came from infostealer malware — a different vector, but the same end result: attackers taking credentials from where they're stored. Whether the theft happens through a poisoned npm package, a phishing email that installs infostealer malware, or a misconfigured cloud server, the attacker's goal is the same.

The reassuring news from the OpenAI incident is that no customer data or production systems were compromised. The less reassuring news — and the reason we're covering this story on a password security site — is that if attackers can reach inside one of the most security-conscious companies in the world by poisoning an npm package, the same attack works on everyone else too. And as the CISA has repeatedly warned, supply chain attacks are the fastest-growing threat vector in cybersecurity.

The lesson isn't that OpenAI's security failed — they detected the breach, contained it, and are rotating credentials. The lesson is that credential theft via supply chain is now a mainstream attack vector, targetting everyone from solo developers to the companies building the next generation of AI. Use strong, unique passwords. Store them in a dedicated password manager. Enable phishing-resistant MFA. Rotate credentials regularly. And if you're running macOS versions of ChatGPT Desktop, Codex, or Atlas — update by June 12.

FAQs: OpenAI TanStack Supply Chain Attack

What happened in the OpenAI TanStack supply chain attack?

Attackers published 84 malicious versions of @tanstack/* npm packages as part of the "Mini Shai-Hulud" campaign. When OpenAI employees' machines downloaded these poisoned packages, the malware stole internal credentials from the company's code repositories. OpenAI is rotating signing certificates for ChatGPT Desktop, Codex App, Codex CLI, and Atlas as a result.

Were OpenAI customer passwords or data compromised?

OpenAI says no. The company stated there is no evidence that customer data, production systems, or deployed software were compromised. The breach was limited to "credential-focused exfiltration" from internal code repositories on two affected employee machines.

Who is behind the Mini Shai-Hulud campaign?

Security researchers have connected the campaign to a threat group known as TeamPCP. The same group has been linked to attacks on SAP-related npm packages and Jenkins plugins, suggesting they're methodically working through the developer toolchain — targeting build infrastructure, package registries, and CI/CD pipelines.

How do supply chain attacks steal credentials?

Attackers compromise a legitimate publisher's credentials and push malicious package versions to public registries like npm. When developers install or update those packages, the malware runs on their machines and searches for GitHub tokens, cloud secrets, npm credentials, and CI/CD authentication material stored in environment variables or local files.

Should users of ChatGPT Desktop, Codex, or Atlas take action?

Yes. OpenAI says users of the macOS versions of ChatGPT Desktop, Codex App, Codex CLI, and Atlas should update their software by June 12 to receive newly signed versions. This ensures you're running software signed with rotated, uncompromised certificates.

Can supply chain credential theft affect individuals, not just companies?

Indirectly, yes. Developers who use npm packages on personal projects could have their GitHub tokens or other credentials stolen. More broadly, the same credential-stealing malware that drives supply chain attacks also targets saved browser passwords and session tokens. Using a dedicated password manager with strong, unique passwords for every account limits the damage if any single credential is stolen.

What is a good first step to protect against supply chain credential theft?

The single most effective step is to never store credentials — API keys, tokens, passwords — in source code. Use environment variables, secret management services, or a dedicated password manager like Bitwarden or 1Password with CLI tooling that injects credentials without writing them to disk.

How does the TanStack attack compare to previous npm supply chain incidents?

The TanStack campaign is notable for its scale — 84 malicious packages across 42 packages — and the fact that it reached OpenAI, one of the most security-conscious technology companies. Previous notable incidents include the Axios-related supply chain issue OpenAI experienced earlier, and the broader trend of North Korean state-backed actors targeting npm ecosystems as documented by the FBI.