OpenAI said two employees’ devices were breached in the Mini Shai-Hulud supply-chain campaign, which spread malicious packages through npm and PyPI and triggered a precautionary rotation of code-signing certificates. The company said customer data, production systems, and deployed software were not impacted, while the broader attack also hit TanStack, Mistral AI, UiPath, Guardrails AI, and OpenSearch. #OpenAI #MiniShaiHulud #TeamPCP #TanStack #MistralAI #UiPath #GuardrailsAI #OpenSearch
Keypoints
- Two OpenAI employees’ devices were breached in the Mini Shai-Hulud campaign.
- The incident did not affect customer data, production systems, or deployed software.
- OpenAI rotated code-signing certificates after they were exposed in the attack.
- The malware targeted developer credentials, including GitHub, npm, AWS, Kubernetes, and SSH secrets.
- The broader campaign compromised hundreds of npm and PyPI packages through legitimate release workflows.