OpenAI Says Mini Shai-Hulud Attack Breached Two Employees’ Devices
Summary
OpenAI said the Mini Shai-Hulud campaign breached two employees’ devices and exposed limited credentials and code-signing certificates. It reported no impact to customer data, production systems, or deployed software and is rotating certificates as a precaution.
Key points
- OpenAI said activity consistent with Mini Shai-Hulud affected two employees’ devices and involved limited internal repositories.
- The company reported that a limited number of credentials were stolen, with no evidence they were used in further attacks.
- OpenAI said customer data, production systems, intellectual property, and deployed software were not affected.
- Code-signing certificates were exposed, but OpenAI said it had not detected their use to sign malicious software; it is rotating them as a precaution.
- OpenAI isolated affected systems and accounts, revoked sessions, rotated credentials, restricted deployment workflows, and conducted a forensic investigation.
- The broader campaign compromised hundreds of npm and PyPI packages, according to researchers cited in the article.
- OpenAI said macOS users must update its desktop apps before June 12, 2026; Windows and iOS users do not need to act.
Article Details
- Victim Organization
- OpenAI
- Incident Type
- Supply-chain campaign-related breach of two employees’ devices, with credential-focused exfiltration from internal source-code repositories.
- Data Types Exposed
- Limited credentials from internal source-code repositories
- Code-signing certificates were exposed; OpenAI reported no detected abuse of them
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- OpenAI isolated affected systems and accounts, revoked sessions, rotated credentials and code-signing certificates, and temporarily restricted deployment workflows. Customer data, production systems, intellectual property, and deployed software were not impacted. Users of OpenAI’s macOS desktop applications must update before June 12, 2026; Windows and iOS users are unaffected.
- Ransom Or Extortion
- No ransom demand or extortion against OpenAI is reported. OpenAI linked the incident to TeamPCP, described in the article as an extortion gang.
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsThe article says stolen GitHub and npm credentials were used to compromise maintainer accounts.T1195.001 · Compromise Software Dependencies and Development ToolsThe campaign distributed malicious package versions through npm and PyPI, including packages published through legitimate release workflows.T1552.001 · Credentials In FilesThe malware targeted .env files and developer credentials.T1552.004 · Private KeysThe malware targeted SSH keys.
Threat Actors
Malware
Products
Claude CodeSecurity researchers say the malware also established persistence on developer systems by modifying Claude Code hooks and VS Code auto-run tasks, enabling it to survive package removal.GitHub ActionsAccording to TanStack’s post-mortem, the attackers abused weaknesses in the project’s GitHub Actions workflows and CI/CD configuration to execute malicious code, extract tokens from memory, and publish maliciousnpmOpenAI said two employees’ devices were breached in the Mini Shai-Hulud supply-chain campaign, which spread malicious packages through npm and PyPI and triggered a precautionary rotation of code-signing certificates.PyPIOpenAI said two employees’ devices were breached in the Mini Shai-Hulud supply-chain campaign, which spread malicious packages through npm and PyPI and triggered a precautionary rotation of code-signing certificates.VS CodeSecurity researchers say the malware also established persistence on developer systems by modifying Claude Code hooks and VS Code auto-run tasks, enabling it to survive package removal.