OpenAI is taking decisive action to secure its software distribution pipeline after a supply chain attack targeted a popular developer tool, leading the company to rotate its macOS code-signing certificates. The move follows the discovery that a GitHub Actions workflow used for signing macOS applications executed a malicious version of the Axios library, a common tool used by developers to produce HTTP requests.
The incident highlights the precarious nature of modern software development, where a single compromised dependency in a third-party library can potentially grant attackers access to critical security infrastructure. While OpenAI reports that no user data was accessed and no internal systems were compromised, the company is treating the certificates as compromised out of an abundance of caution.
This security breach is linked to a broader campaign attributed by the Google Threat Intelligence Group (GTIG) to a North Korean hacking group tracked as UNC1069. The attackers hijacked a package maintainer’s npm account to push poisoned versions of the Axios library, which then deployed a cross-platform backdoor known as WAVESHAPER.V2 to target Windows, macOS, and Linux systems according to reports on the Axios supply chain incident.
For users, the immediate impact of this rotation is a prompt to update their Mac applications. As the previous certificates are being revoked, older versions of the software may no longer be recognized as legitimate by macOS, necessitating an update to the latest, securely signed versions.
Understanding the Axios Supply Chain Attack
A supply chain attack occurs when a threat actor infiltrates a trusted third-party vendor or software library to gain access to the downstream users of that software. In this case, the target was Axios, a widely used npm package. On March 31, 2026, poisoned versions 1.14.1, and 0.30.4 were pushed to the registry, embedded with a malicious dependency called “plain-crypto-js” as detailed by security researchers.
OpenAI confirmed that one of its GitHub Actions workflows—the automated system used to build and sign its software—downloaded and executed Axios version 1.14.1. This specific workflow had access to the notarization material and certificates used to sign several of the company’s primary macOS offerings, including:
- ChatGPT Desktop
- Codex
- Codex CLI
- Atlas
Code-signing certificates are essential for security on macOS. They act as a digital seal of authenticity, telling the operating system that the software comes from a verified developer and has not been altered by a third party. If a certificate is stolen, a hacker could potentially sign a malicious app, making it look like a legitimate piece of software from OpenAI.
Risk Assessment and Mitigation
Despite the execution of the malicious payload, OpenAI’s internal analysis suggests that the signing certificate was likely not successfully exfiltrated. The company cited several mitigating factors for this conclusion, including the specific timing of the payload execution, the sequence of the job, and how the certificate was injected into the workflow via OpenAI’s official response.
However, in the world of cybersecurity, “likely not” is not a sufficient guarantee. By revoking and rotating the certificates, OpenAI is effectively resetting the lock on its digital door. Any one-off attempt by an attacker to use a stolen version of the ancient certificate will now fail because the certificate is no longer trusted by Apple’s notarization service.
The company stated, “We found no evidence that OpenAI user data was accessed, that our systems or intellectual property were compromised, or that our software was altered” in a post regarding the incident. This indicates that while the “plumbing” of the software delivery process was touched by the malware, the actual product delivered to users remained untainted.
What This Means for macOS Users
The most visible result of this security rotation is that macOS users may see notifications asking them to update their OpenAI applications. Because the old certificates are being revoked, the operating system may flag older versions of the apps as unsigned or untrusted.
What we have is a standard security procedure. When a developer rotates a certificate due to a potential compromise, the only way to maintain a “trusted” status on the user’s machine is to download the version of the app signed with the new, secure certificate. Users are encouraged to keep their software updated to ensure they are using the most secure version of the tools.
Key Takeaways from the Incident
- The Trigger: A compromised npm package (Axios) was used to deliver the WAVESHAPER.V2 backdoor.
- The Exposure: A GitHub Actions workflow used for macOS app-signing executed the malicious code.
- The Impact: No user data or intellectual property was stolen, but signing certificates were potentially exposed.
- The Fix: OpenAI is revoking and rotating the certificates for ChatGPT Desktop, Codex, Codex CLI, and Atlas.
- User Action: Update all OpenAI macOS applications to the latest version.
This event serves as a stark reminder of the risks associated with automated build pipelines. As AI companies scale their software footprints, the complexity of their dependency chains increases, providing more opportunities for state-sponsored actors, such as the UNC1069 group, to find a weak link in the chain.
OpenAI has not announced further scheduled actions regarding this specific incident, but the rotation of certificates is the primary corrective measure. Users should continue to monitor official OpenAI channels for any further security advisories.
Do you have questions about how supply chain attacks affect your software? Share your thoughts in the comments below.
Worth a look