Hackers Target Open Source: OpenAI Hit by Malware Attack

Recent "supply chain" attacks have targeted open source projects, with hackers pushing malware disguised as software updates. OpenAI confirmed that two employee devices were affected by a compromise of the TanStack library, a tool used for building web applications. These malicious updates were designed to steal credentials and spread to other systems. While OpenAI's investigation found no evidence of user data compromise or impact on production systems, limited unauthorized access to internal source code repositories occurred. As a precautionary measure, OpenAI is rotating digital certificates to secure its products, a step that may require macOS users to update their applications. The perpetrators behind the TanStack attack remain unknown, though similar tactics have been attributed to groups like TeamPCP and state-sponsored hackers from North Korea and China in past incidents. These attacks leverage open source projects to potentially compromise numerous targets with a single infiltration.