Axios Supply Chain Attack Aftermath: All Old Versions of OpenAI Mac Apps Will Stop Working Starting Tomorrow

CryptoWorld News reports that Axios states that, due to a supply chain attack, OpenAI’s macOS signing certificate will be officially revoked tomorrow (May 8). At that time, outdated versions of ChatGPT Desktop, Codex, Codex CLI, and Atlas that have not been updated will be unable to start.

This incident traces back to the npm supply chain attack on March 31. The attackers used stolen maintainer accounts to publish two malicious versions (1.14.1 and 0.30.4), injecting a fake dependency, plain-crypto-js, which led to the download of a remote access trojan (RAT) during installation and overwrote components across the macOS, Windows, and Linux platforms.

Microsoft attributes the attack to the North Korean hacker organization Sapphire Sleet.

OpenAI’s analysis believes the certificate was not successfully stolen, but certificates have already been rotated and OpenAI has worked with Apple to block notarization channels for the old certificates. So far, no user data leaks or system intrusions have been found, and passwords and API Key are also unaffected.

The root cause is a workflow configuration issue: when referencing dependencies, it used floating version tags rather than a fixed commit hash.

View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments
  • Pin