OpenAI explains TanStack npm attack, asks users to update macOS apps by June 12

OpenAI has described how it responded to the Mini Shai-Hulud attack through the TanStack npm ecosystem. The company says it found no sign that user data, production systems or its products' code were compromised, but it is still launching a mandatory macOS app update with a deadline of June 12, 2026.

What happened

On May 11, 2026 UTC, attackers compromised one of the popular open-source packages in the TanStack ecosystem. OpenAI says the attack was part of a broader Mini Shai-Hulud campaign that targeted not a single company but shared links in the software supply chain: dependencies, package managers and development tools.

Inside OpenAI, two employee devices in the corporate environment were affected. After detecting the malicious activity, the company opened an investigation and brought in an external digital forensics and incident response team.

According to OpenAI, the malicious package behaved as in the already documented scenario: unauthorized access and attempts to exfiltrate credentials from a limited set of internal repositories that these two employees could access. The company states that only certain secrets and credentials were actually exfiltrated, and that no other code or information was affected. The investigation found no evidence of impact on user data, production systems or OpenAI's intellectual property.

How OpenAI responded

The first task was to contain the incident and cut off possible routes to further access. OpenAI isolated the affected devices and their associated accounts, revoked user sessions, rotated all credentials in the affected repositories and temporarily restricted code-deployment workflows. In parallel, the company separately reviewed the behavior of the accounts and the secrets themselves to determine whether anyone had already used the stolen material. As of publication, OpenAI says it has seen no sign of follow-on access by the attacker or misuse of this data.

"We found no evidence that

OpenAI user data was compromised."

One important detail: the affected repositories also held signing certificates for OpenAI products. So the response went beyond cleaning infected machines. The company began rotating its code-signing certificates and separately arranged with platform partners to block new notarization using the old signing material. OpenAI also re-checked software it had already released and found no sign that anyone had signed a malicious app in its name or tampered with published builds.

OpenAI also explained that after the Axios incident it sped up the rollout of additional anti-supply-chain measures, but this case landed during the rollout phase. The two affected devices had not yet received the updated package-manager configurations and the new package-provenance checks. The measures the company now highlights include minimumReleaseAge for dependencies, stronger protection of sensitive credentials in CI/CD, and additional provenance validation for new packages.

What Mac users should do

For ordinary users, the takeaway is practical: if you use OpenAI apps on macOS, you need to update them by June 12, 2026. Once the old certificate is fully revoked, macOS will begin blocking new downloads and the first launch of apps signed with the previous keys. OpenAI is deliberately leaving a window until that date, because an immediate revocation could break legitimate updates and the first launch of normal apps for some users.

• You need to update ChatGPT Desktop
• You need to update Codex App
• You need to update Codex CLI
• You need to update Atlas

Windows and iOS users need to take no separate action, although the company is reissuing apps with new certificates on all affected platforms. According to OpenAI, user passwords and API keys were not affected, so there is no need to change them.

The safest route is to install updates only through the app's built-in mechanism or official download pages. OpenAI also warns users not to install "OpenAI," "ChatGPT" or "Codex" from emails, ads, messengers or third-party catalogs.

What this means

The incident shows how quickly dependency attacks can leave the developer environment and reach ordinary users through certificates, desktop clients and update mechanisms. The lesson for companies is simple: checking your own code is not enough. You also need tight control over package provenance, protected CI/CD, and the ability to reissue signatures quickly without halting the product.