OpenAI says no user data stolen after supply-chain hackers accessed employee devices

OpenAI said it found no evidence that user data was accessed after a supply-chain attack involving the TanStack npm library. The incident has renewed concerns about the security of open-source software, as researchers warn that malicious npm packages can expose developer credentialsOpenAI says no evidence of user data access after TanStack npm security issue(AP)OpenAI has said it found no evidence that user data was accessed following a security issue linked to a supply-chain attack involving the open-source TanStack npm library.The company said in a security update published on its official website that the issue was part of a broader software supply-chain attack campaign known as “Mini Shai-Hulud”, which targeted open-source developer ecosystems including npm and PyPI.What happened?According to a postmortem published by TanStack on 11 May, attackers published 84 malicious versions across 42 @tanstack/* npm packages after exploiting weaknesses in GitHub Actions workflows and CI/CD cache systems.Cybersecurity firm Snyk and security researchers cited in Tom's Hardware's reporting said the malicious packages were designed to steal credentials such as GitHub tokens, cloud API keys, npm credentials, and CI/CD secrets from infected systems.The attack was part of a wider campaign affecting several developer ecosystems and software projects, including packages linked to Mistral AI, UiPath, and OpenSearch, according to security researchers and Reddit community discussions.What did OpenAI say?In its official response, OpenAI said two employee devices in its corporate environment were impacted by the attack. The company said it observed “unauthorised access and credential-focused exfiltration activity” involving a limited subset of internal source-code repositories accessible to those employees.OpenAI said in a security update published on its official website that only limited credential material was successfully exfiltrated and that it found no evidence that customer data, production systems, intellectual property or software code were compromised.The company added that it isolated impacted systems, revoked sessions, rotated credentials, and updated security certificates for some products as a precautionary measure.Why does it matter?The incident has renewed scrutiny of security risks in open-source software supply chains, particularly in ecosystems such as npm, which are widely used across the technology industry, following a series of recent attacks targeting popular JavaScript packages and developer tools, according to reports by Ars Technica and CSO Online.Academic and industry studies have repeatedly warned about the growing risks posed by malicious npm packages and compromised maintainer accounts. A 2021 research paper titled “What are Weak Links in the npm Supply Chain?” by researchers from Microsoft, North Carolina State University and other institutions found that attackers could potentially hijack thousands of npm packages through weak maintainer-account protections and other vulnerabilities in the ecosystem.Other academic studies on software supply-chain attacks have also documented increasing abuse of package managers such as npm and PyPI to distribute malware and compromise downstream users and enterprises, including the 2020 paper “Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks” and later studies examining malicious package detection across npm and PyPI ecosystems.Get Latest real-time updatesStay updated with the latest Trending, India , World and US news. HomeNewsWorldOpenAI says no user data stolen after supply-chain hackers accessed employee devicesMore