OpenAI Revokes macOS Signing Certificate After Malicious Axios Package Reached CI Workflow
Summary
OpenAI says its macOS app-signing workflow ran malicious Axios 1.14.1. It found no evidence of user data access or system compromise and says the signing certificate was likely not exfiltrated, but is revoking and rotating it.
Key points
- A GitHub Actions workflow used to sign OpenAI macOS apps downloaded and executed Axios 1.14.1 on March 31, with access to signing and notarization material.
- OpenAI found no evidence that user data or internal systems were accessed, and assessed that the signing certificate was likely not exfiltrated; it is nevertheless treating the certificate as compromised and rotating it.
- Starting May 8, 2026, older macOS app versions will no longer receive updates or support, and apps signed with the previous certificate will be blocked by macOS protections by default.
- Google Threat Intelligence Group attributed the Axios npm compromise to UNC1069. Malicious Axios versions contained a dependency that deployed the WAVESHAPER.V2 backdoor.
- A separate Trivy supply-chain campaign attributed to TeamPCP involved stolen developer credentials and malicious packages and workflows, including impacts involving LiteLLM and Telnyx.
- GitGuardian reported that 474 public repositories executed malicious code from the compromised trivy-action workflow, while 1,750 Python packages were configured to pull poisoned versions.
- Recommended defenses include pinning dependencies, using short-lived scoped credentials and internal mirrors, and sandboxing CI runners; CISA added CVE-2026-33634 to its KEV catalog.
Article Details
- Event Type
- OpenAI disclosed that its macOS app-signing workflow downloaded a malicious Axios package during a software supply-chain compromise. The incident prompted certificate revocation and rotation; the article also describes related Trivy supply-chain attacks.
- Impact
- OpenAI reported no evidence that user data, internal systems, intellectual property, or software were compromised, and said the signing certificate was likely not successfully exfiltrated. It is treating the certificate as compromised, has stopped new notarizations with it, and will stop supporting older macOS app versions after 2026-05-08; apps signed with the previous certificate will be blocked by macOS security protections by default. Separately, the Trivy campaign affected packages and workflows across multiple ecosystems. The article reports confirmed compromise of Mercor and the European Commission; LAPSUS$ claimed to have exfiltrated about 4 TB from Mercor.
MITRE ATT&CK
CVE
People
Brett LeathermanThe FBI Cyber Division assistant director warned that compromising security tools such as Trivy can expose sensitive environments because they may have broad access.Charles CarmakalMandiant Consulting's chief technology officer at Google urged enterprises to assess the impact of recent supply-chain campaigns and remediate and harden their environments.Mark LechnerDocker's chief information security officer commented on supply-chain risks and recommended verification practices such as pinned references, scoped credentials, and sandboxed execution.
Threat Actors
LAPSUS$The article says TeamPCP teamed with LAPSUS$; separately, LAPSUS$ listed Mercor on its leak site and claimed to have exfiltrated about 4 TB of data.ShinyHuntersThe article says TeamPCP teamed with ShinyHunters and reports that ShinyHunters publicly released data exfiltrated from the European Commission.TeamPCPThe article attributes the Trivy supply-chain attacks, credential theft, and deployment of SANDCLOCK and CanisterWorm to TeamPCP.UNC1069Google Threat Intelligence Group attributed the Axios npm supply-chain compromise to UNC1069, described in the article as North Korean-linked.VectThe article says TeamPCP teamed with Vect and other financially motivated groups while seeking to monetize previously stolen credentials.
Malware
CanisterWormSeparately, TeamPCP (aka UNC6780) exploited Trivy to steal credentials and push malware (SANDCLOCK, CanisterWorm) into multiple ecosystems, affecting packages like LiteLLM and Telnyx.DonutLoadernamed “msbuild.exe” that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and aSANDCLOCKSeparately, TeamPCP (aka UNC6780) exploited Trivy to steal credentials and push malware (SANDCLOCK, CanisterWorm) into multiple ecosystems, affecting packages like LiteLLM and Telnyx.WAVESHAPER.V2May 8, 2026, and the incident is linked to GTIG attribution of the npm compromise to UNC1069 and the WAVESHAPER.V2 backdoor.
Vendors
AppleAs part of its remediation efforts, OpenAI is also working with Apple to ensure software signed with the previous certificate cannot be newly notarized.Aqua SecurityThe other incident targeted Trivy, a vulnerability scanner maintained by Aqua Security, resulting in cascading impacts across five ecosystems, affecting a number of other popular libraries depending on it.CheckmarxDays later, the crew used secrets pilfered from the Trivy intrusion to inject the same malware into two GitHub Actions workflows maintained by Checkmarx.Docker“Trust was assumed where it should have been verified,” Mark Lechner, chief information security officer at Docker, said.GitGuardianGitGuardian’s analysis of the Trivy and LiteLLM supply chain attacks and their spread through dependencies and automation pipelines has found that 474 public repositories executed malicious code from the compromisedGoogleGoogle Threat Intelligence Group attributed the Axios npm compromise to the North Korean-linked group UNC1069.Mandiant“The number of recent software supply chain attacks is overwhelming,” Charles Carmakal, chief technology officer of Mandiant Consulting at Google, said.OpenAIOpenAI disclosed that a GitHub Actions workflow used to sign its macOS apps downloaded a malicious Axios package (version 1.14.1) tied to a supply-chain compromise, but said no user data or internal systems wereTrend Microsupply chain activity, with adjustments to tooling, delivery methods, and platform coverage,” Trend Micro said in an analysis of the attack.Wiz“The credentials and secrets stolen in the supply chain compromises were quickly validated and used to explore victim environments and exfiltrate additional data,” Wiz researchers said.
Products
AtlasThe workflow, it added, had access to a certificate and notarization material used for signing ChatGPT Desktop, Codex, Codex CLI, and Atlas.AxiosOpenAI disclosed that a GitHub Actions workflow used to sign its macOS apps downloaded a malicious Axios package (version 1.14.1) tied to a supply-chain compromise, but said no user data or internal systems wereChatGPT DesktopThe workflow, it added, had access to a certificate and notarization material used for signing ChatGPT Desktop, Codex, Codex CLI, and Atlas.CodexThe workflow, it added, had access to a certificate and notarization material used for signing ChatGPT Desktop, Codex, Codex CLI, and Atlas.Codex CLIThe workflow, it added, had access to a certificate and notarization material used for signing ChatGPT Desktop, Codex, Codex CLI, and Atlas.GitHub ActionsOpenAI disclosed that a GitHub Actions workflow used to sign its macOS apps downloaded a malicious Axios package (version 1.14.1) tied to a supply-chain compromise, but said no user data or internal systems wereLiteLLMSeparately, TeamPCP (aka UNC6780) exploited Trivy to steal credentials and push malware (SANDCLOCK, CanisterWorm) into multiple ecosystems, affecting packages like LiteLLM and Telnyx.Telnyx Python SDKOn Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named “msbuild.exe” that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode
Tools
AdaptixC2from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.TrivySeparately, TeamPCP (aka UNC6780) exploited Trivy to steal credentials and push malware (SANDCLOCK, CanisterWorm) into multiple ecosystems, affecting packages like LiteLLM and Telnyx.TruffleHogTo that end, the cybercrime gang has been found to verify stolen credentials using TruffleHog, launch discovery operations within 24 hours of validation, exfiltrate more data, and attempt lateral movement to gain access
Industries
Artificial intelligenceThe artificial intelligence (AI) company said a GitHub Actions workflow it uses as part of its macOS app-signing process downloaded and executed Axios version 1.14.1.GovernmentIndustry and government responses include CISA adding CVE-2026-33634 to its KEV list and recommendations such as pinning packages, short-lived credentials, internal mirrors, sandboxed CI runners, and enforcing 2FA.Telecommunications“In just eight days, the actor has pivoted across security scanners, AI infrastructure, and now telecommunications tooling, evolving their delivery from inline Base64 to .pth auto-execution, and ultimately to split-file