Clarissa Hana
OpenAI is proactively rotating its potentially exposed macOS code-signing certificates following a sophisticated supply chain attack that involved a malicious version of the popular JavaScript package, Axios. The incident, which came to light on March 31, 2026, saw a legitimate GitHub Actions workflow inadvertently download and execute a compromised Axios package (version 1.14.1). This compromised package was subsequently used in attacks to deploy malware onto unsuspecting devices. The critical nature of this compromise stems from the fact that the compromised workflow possessed access to code-signing certificates vital for authenticating OpenAI’s macOS applications, including its flagship ChatGPT Desktop, Codex, Codex CLI, and Atlas.
While OpenAI’s internal investigation has thus far revealed no direct evidence that the signing certificate itself was compromised, the company is adopting an extreme stance of caution. Consequently, OpenAI is undertaking the process of revoking and rotating these crucial certificates to mitigate any potential future risks. This precautionary measure underscores the evolving threat landscape of software supply chain attacks, where even seemingly minor vulnerabilities in widely used development tools can have far-reaching implications for major technology organizations.
The Anatomy of the Attack
The attack vector employed by malicious actors targeted the open-source ecosystem, a cornerstone of modern software development. Researchers have linked the compromise of the Axios npm package to North Korean threat actors, specifically identified as UNC1069. This group is known for its persistent efforts to infiltrate popular open-source projects as a means of executing widespread supply chain attacks.
The UNC1069 campaign reportedly initiated with a social engineering effort directed at a maintainer of the Axios project. This involved the orchestration of a deceptive web conference call, which ultimately led to the installation of malware on the maintainer’s system. Upon gaining unauthorized access to the maintainer’s account, the threat actors were able to publish malicious versions of the Axios package to the npm registry.
This compromised package contained a critical dependency designed to install a remote access trojan (RAT) capable of operating across multiple operating systems, including macOS, Windows, and Linux. The attackers’ methodology, as detailed by security researchers, involved approaching developers through highly convincing fake collaboration setups. These often included simulated Slack workspaces and Microsoft Teams calls, meticulously crafted to trick unsuspecting individuals into downloading and executing malware. The ultimate goal was to achieve credential theft, which then paved the way for broader downstream supply chain compromises, such as the one affecting OpenAI.
Timeline of Events and OpenAI’s Response
March 31, 2026: A legitimate GitHub Actions workflow utilized by OpenAI executes a compromised version (1.14.1) of the Axios package. This package, inadvertently downloaded, contained malicious code.
Early April 2026: OpenAI’s security team detects anomalous activity or is alerted to the potential compromise. An internal investigation is immediately launched to ascertain the scope and impact of the incident.
March 31, 2026 (ongoing): OpenAI’s investigation, in collaboration with a third-party incident response firm, begins. The focus is on understanding how the malicious Axios package was introduced and what access it gained.
April 2026 (specific date not provided): OpenAI determines that the compromised workflow had access to its macOS code-signing certificates. While no direct compromise of the certificates is found, the potential for exploitation is recognized.
April 2026 (specific date not provided): OpenAI issues a security advisory to its users, detailing the incident and the necessary steps for mitigation.
May 8, 2026: The compromised code-signing certificate is scheduled for full revocation by OpenAI and Apple. Applications signed with this certificate will cease to function on macOS.
Ongoing: OpenAI continues to monitor for any signs of misuse of the old certificate and may expedite the revocation timeline if suspicious activity is detected.
In response to the discovery, OpenAI stated, "Out of an abundance of caution, we are taking steps to protect the process that certifies our macOS applications are legitimate OpenAI apps. We found no evidence that OpenAI user data was accessed, that our systems or intellectual property was compromised, or that our software was altered." This statement highlights the company’s commitment to transparency and user trust, even in the face of a sophisticated attack.
The company has further elaborated on the implications for its users: "We are updating our security certificates, which will require all macOS users to update their OpenAI apps to the latest versions." This proactive measure is crucial for ensuring the integrity and trustworthiness of OpenAI’s software distribution channels.
Implications for macOS Users
The direct consequence for macOS users is the mandatory update of their OpenAI applications. Versions of ChatGPT Desktop, Codex, Codex CLI, and Atlas signed with the compromised certificate will cease to function on macOS starting May 8, 2026. This is due to macOS’s built-in security protections, which will block the execution of applications signed with a revoked certificate. Users are strongly advised to perform these updates through the in-app update features or by downloading the latest versions directly from OpenAI’s official download pages.
Furthermore, OpenAI has issued a stern warning against installing software from untrusted sources. Users are encouraged to be vigilant and avoid downloading applications from links received via email, suspicious advertisements, or third-party websites, as these can be vectors for malware distribution.
The incident serves as a stark reminder of the inherent risks associated with the software supply chain. Developers and organizations rely heavily on third-party libraries and tools, and a compromise at any point in this chain can have cascading effects. The Axios attack, in particular, demonstrates the increasing sophistication of threat actors who are actively seeking to exploit the interconnected nature of the software development ecosystem.
Broader Impact and Analysis
The compromise of the Axios package and its subsequent impact on OpenAI underscores several critical trends in cybersecurity:
- The Rise of Supply Chain Attacks: These attacks are becoming increasingly prevalent and sophisticated. By targeting popular libraries or developer tools, attackers can gain access to a vast number of downstream users. The SolarWinds attack in 2020 and the Log4j vulnerability in 2021 are prominent examples of the devastating impact of supply chain compromises.
- The Importance of Open-Source Security: Open-source software is the backbone of much of the technology we use daily. However, the decentralized nature of its development can sometimes make it vulnerable to malicious actors who can exploit contributions or compromise maintainer accounts. This incident highlights the need for enhanced security practices within open-source communities, including rigorous code review, dependency scanning, and multi-factor authentication for maintainers.
- Proactive Security Measures: OpenAI’s decision to rotate certificates, even without definitive proof of compromise, demonstrates a mature and proactive security posture. The "assume breach" mentality and the willingness to take drastic measures to protect users are essential in today’s threat landscape. The collaboration with Apple to ensure future notarization is blocked with the old certificate further solidifies this proactive approach.
- User Education and Vigilance: The incident reinforces the ongoing need for user education and awareness. Users must understand the risks associated with downloading software from unverified sources and the importance of keeping their applications updated.
While OpenAI’s investigation found no evidence that user data, intellectual property, or OpenAI’s internal systems were compromised, the potential for a compromised signing certificate to legitimize malicious software cannot be overstated. Such a certificate could be used to sign malware that bypasses security checks, making it appear as though it originates from a trusted source like OpenAI. This would severely damage user trust and could lead to widespread infection.
The company’s swift action in revoking and rotating certificates, coupled with clear communication to its user base, is a best practice in incident response. The collaboration with Apple signifies a coordinated effort to lock down the compromised element and prevent future exploitation.
The Axios supply chain attack, attributed to UNC1069, is part of a larger pattern of state-sponsored or sophisticated criminal groups targeting the software development lifecycle. Their success in compromising a popular package like Axios and then leveraging it to target organizations like OpenAI highlights the critical need for continuous investment in cybersecurity defenses, both by individual companies and by the broader technology ecosystem. OpenAI’s experience serves as a valuable case study for other organizations on how to respond to and mitigate the impact of such complex and insidious threats. The ongoing monitoring and potential acceleration of the revocation timeline demonstrate a commitment to staying ahead of any lingering threats.
