OpenAI: Employee credentials stolen after TanStack supply‑chain attack

Colleagues, I want to draw attention to a cybersecurity incident.

Attackers hijacked TanStack releases—publishing 84 malicious versions in six minutes. The malware stole credentials and self‑propagated.

OpenAI confirms two employee devices were compromised and credentials from restricted repositories were exfiltrated. No user data or code changes have been detected, but OpenAI is rotating digital certificates—macOS will require updates.

Why it matters: supply‑chain attacks can affect many targets simultaneously; dependency hygiene and secret rotation are critical.

Which supply‑chain protection measures do you consider priorities?

#cybersecurity #supplychain #opensource #infosec