OpenAI has confirmed that a recent supply-chain cyberattack led to unauthorized access and the theft of credentials from a limited subset of its internal source code repositories, impacting two employee devices. This incident is part of a growing trend of sophisticated cyberattacks targeting software developers and the open-source projects they rely on.

The breach at OpenAI originated from an earlier attack on TanStack, a popular open-source library utilized by developers to build web applications. TanStack disclosed that hackers published 84 malicious versions of its software during a brief six-minute window. The embedded malware was designed to steal credentials from infected computers and to self-propagate to other systems. Following an internal investigation, OpenAI stated there is no evidence that user data was accessed, production systems or intellectual property were compromised, or its software was altered.

In response to the credential theft and unauthorized access to its internal source code, OpenAI is implementing precautionary measures. The affected repositories contained digital certificates used to sign the company’s products, prompting a rotation of these certificates. This action will necessitate macOS users to update their OpenAI applications. The company reiterated that it has found no evidence of compromise or risk to existing software installations.

The perpetrators behind the TanStack attack remain unknown. However, similar supply-chain hacks have been attributed to various groups. Past incidents include attacks linked to the hacking group TeamPCP. Other notable examples include North Korean hackers compromising the Axios open-source development tool in March, potentially infecting millions of developers, and Chinese hackers accused of a similar attack in May targeting thousands of Windows computers running Daemon Tools disc-imaging software. These types of attacks exploit vulnerabilities in widely used open-source projects, distributing malware disguised as routine updates to compromise numerous targets simultaneously.