🔥36氪•Stalecollected in 3m
OpenAI confirms no user data leak in TanStack attack
💡Critical security update for OpenAI users; learn how to protect your dev environment from supply chain attacks.
⚡ 30-Second TL;DR
What Changed
No evidence of user data breach or unauthorized access found.
Why It Matters
This highlights the growing risk of supply chain vulnerabilities in AI-integrated software. It serves as a reminder for developers to audit dependencies in their own AI stacks.
What To Do Next
Audit your project's npm dependencies for the 'Mini Shai-Hulud' vulnerability and update your local OpenAI macOS client immediately.
Who should care:Developers & AI Engineers
Key Points
- •No evidence of user data breach or unauthorized access found.
- •Internal systems were audited following the TanStack supply chain attack.
- •Mandatory software update required for all macOS application users by June 12, 2026.
🧠 Deep Insight
Web-grounded analysis with 19 cited sources.
🔑 Enhanced Key Takeaways
- •The 'Mini Shai-Hulud' attack, attributed to TeamPCP, compromised hundreds of open-source packages across both npm and PyPI ecosystems, including prominent libraries like TanStack, MistralAI, UiPath, and OpenSearch.
- •The attack exploited a sophisticated chain of three GitHub Actions vulnerabilities: a 'pull_request_target' 'Pwn Request' pattern, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime memory extraction of an OpenID Connect (OIDC) token.
- •The malicious payload, a 2.3MB heavily obfuscated JavaScript file named
router_init.js, was designed to steal various credentials, including AWS, GCP, Kubernetes, Vault, GitHub, npm, and SSH keys, and then self-propagate across the ecosystem. - •OpenAI's investigation confirmed that two employee devices in their corporate environment were impacted by the attack, but found no evidence of user data access, compromise of production systems or intellectual property, or alteration of their software.
- •Notably, the compromised packages carried valid SLSA Build Level 3 provenance attestations, marking this as the first documented npm worm to produce legitimately attested malicious packages by hijacking the trusted build pipeline itself.
🛠️ Technical Deep Dive
- The 'Mini Shai-Hulud' is a multi-vector supply chain worm that leverages Bun runtime smuggling for EDR evasion.
- It scrapes GitHub Actions runner memory for secrets and harvests credentials from major cloud providers (AWS, GCP, Kubernetes, HashiCorp Vault) and secrets management systems.
- The attack abuses GitHub Actions workflows by exploiting overly broad permissions, often triggered by an 'orphaned commit' to initiate automated release processes.
- The malware injects a secret-dumping GitHub Actions workflow disguised as Dependabot and poisons repository branches with files camouflaged as Claude AI configuration.
- Self-propagation occurs by using stolen npm tokens and hijacked GitHub Actions OIDC tokens to publish poisoned versions of additional packages that the compromised account has write access to.
- The malicious payload (
router_init.js) employs aggressive obfuscation techniques, including string-array rotation, hex-encoded identifier lookups, control-flow flattening withinwhile(!![]){}state machines, and dead-code injection. - The attack chained specific GitHub Actions vulnerabilities: the
pull_request_target'Pwn Request' pattern, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime memory extraction of an OIDC token from the Actions runner process. - The malware utilizes Bun, a high-speed JavaScript engine, for systematically stealing security keys and passwords.
🔮 Future ImplicationsAI analysis grounded in cited sources
Software supply chain attacks will continue to increase in sophistication and target developer infrastructure.
The 'Mini Shai-Hulud' attack demonstrates advanced techniques, such as abusing trusted publishing and producing valid SLSA provenance, indicating a shift towards more complex and harder-to-detect attacks on the interconnected open-source ecosystem.
Organizations will need to significantly enhance their security measures for CI/CD pipelines and third-party dependencies.
The incident highlights the critical vulnerability of automated workflows and the necessity for stricter controls, including repository-owner guards and pinning third-party action references, to prevent similar compromises.
⏳ Timeline
2025-09
Initial waves of the Shai-Hulud worm campaign begin, utilizing a similar toolchain.
2026-03-31
A separate supply chain attack involving the Axios library compromises a third-party developer tool used by OpenAI, exposing certificates for macOS apps.
2026-04-10
OpenAI announces a mandatory update for macOS apps by May 8, 2026, due to the Axios incident.
2026-04-29
Malicious versions of SAP-related npm packages are published as part of the 'Mini Shai-Hulud' campaign.
2026-05-11
Attackers publish 84 malicious versions across 42 TanStack npm packages between 19:20 and 19:26 UTC, which are detected publicly within 20 minutes.
2026-05-14
OpenAI confirms no user data leak in the TanStack 'Mini Shai-Hulud' supply chain attack and advises macOS users to update apps by June 12, 2026.
📎 Sources (19)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
📰
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: 36氪 ↗