TanStack supply chain was poisoned, and they lost all internal credentials but still claim that core data was unaffected? I know this kind of statement well.

OpenAI has confirmed that its internal network suffered a malicious NPM package supply-chain attack targeting TanStack. Two employees’ devices were infected. Core data was not affected, but internal credentials and code-signing certificates were stolen. To prevent application forgery, certificate rotation will be carried out. macOS users must upgrade before 2026-06-12, and the old certificates will be revoked. iOS/Windows clients and key security are unaffected; updates must be completed within the grace period.