OpenAI: No User Data Breach in TanStack Supply Chain Attack

On May 14, OpenAI released a statement regarding the “Mini Shai-Hulud” supply chain attack targeting the popular open-source library TanStack and multiple npm packages, confirming that its security team found no evidence of user data breach or unauthorized access following an internal system audit.

Security Audit Findings

After detecting the malicious attack on commonly used npm packages, OpenAI’s security team conducted a comprehensive review of its internal systems. The company confirmed that its core services were not directly compromised by the attack. However, to ensure the security of local environments, OpenAI has issued a mandatory software update requirement for all macOS users of its official applications.

Required Action for Users

All macOS users utilizing OpenAI’s official applications are required to complete a software update by June 12, 2026, to maintain security compliance and protect their local environments.