OpenAI says no user data breached after security issue with open-source library
OpenAI said two corporate devices were affected but found no evidence that customer data, products or software were compromised.
- OpenAI confirmed Wednesday that no user data or products were compromised following the TanStack supply-chain attack, stating its software remains unaltered.
- On May 11, hackers hijacked TanStack's legitimate release pipeline to publish 84 malicious versions across 42 packages during a six-minute window. A researcher detected the attack within 20 minutes.
- Two employee devices in OpenAI's corporate environment were compromised, resulting in theft of "limited credential material" from internal code repositories. The company isolated affected machines and is rotating digital certificates.
- Consequently, macOS users of the ChatGPT desktop app must perform forced application updates this week, while OpenAI has temporarily restricted code-deployment workflows.
- This incident is the latest "supply chain" attack targeting open source developers, mirroring the Mini Shai-Hulud worm that has compromised more than 170 packages across PyPI and other registries.
19 Articles
19 Articles
OpenAI caught in TanStack npm supply chain chaos after employee devices compromised
OpenAI says attackers behind the TanStack npm supply chain compromise stole internal credentials after reaching two employee devices, forcing the company to rotate signing certificates for several desktop products. The company disclosed this week that it had been caught up in the wider "Mini Shai-Hulud" campaign targeting npm ecosystems and developer infrastructure, though it said there was no evidence that customer data, production systems, or …
TechCrunch
OpenAI says hackers stole some data after latest code security issue
OpenAI said the damage was limited to the employees’ devices, and did not affect user data nor its production systems, and none of its intellectual property was stolen.
OpenAI says no user data was touched in the TanStack npm worm
Two corporate laptops, some credential material, and a forced macOS app update. The interesting part is how the malicious packages got published in the first place: not by a stolen npm password, but by TanStack’s own legitimate release pipeline, after the attacker code took over the runner mid-build. OpenAI said on Wednesday that it found […] This story continues at The Next Web
Coverage Details
Bias Distribution
- 50% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
