The campaign is the work of TeamPCP, the same crew running the Mini Shai-Hulud wave.

Two employee devices in OpenAI's corporate environment were compromised through the malicious TanStack packages.

The attackers used that foothold to reach a limited subset of internal source code repositories.

OpenAI says only "limited credential material" was successfully exfiltrated, with no customer data, production systems, intellectual property or deployed software impacted.

Here is the part that should grab your attention.

OpenAI is rotating its code-signing certificates and forcing every macOS user to update their OpenAI apps.

You do not rotate signing certs for "limited credential material."

You rotate signing certs when the attacker was close enough to signing malicious binaries as OpenAI.

The "we contained it in time" framing is doing serious heavy lifting here.

For wider context, the same TeamPCP wave also hit Mistral AI, UiPath, Guardrails AI, OpenSearch and SAP npm packages. The TanStack compromise is tracked as CVE-2026-45321 at CVSS 9.6, and Mistral AI source code is already being advertised for sale by the group.

https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/