OpenAI Revokes macOS App Certificate After North Korea's Axios Supply Chain Attack — Update ChatGPT Before May 8

The Axios supply chain attack was attributed by Google's Threat Intelligence Group to UNC1069, a North Korean state-sponsored hacking group. The attackers hijacked the npm account of the package maintainer and pushed two poisoned versions — 1.14.1 and 0.30.4 — that bundled a malicious dependency called plain-crypto-js. This dependency deployed a cross-platform backdoor named WAVESHAPER.V2 capable of infecting Windows, macOS, and Linux systems simultaneously.

OpenAI's GitHub Actions workflow for macOS app signing pulled Axios version 1.14.1 as part of its automated pipeline on March 31. The workflow had access to the certificate and notarization material used to cryptographically sign all four of OpenAI's macOS applications, telling macOS that these apps are genuine, trusted OpenAI software. When a signing certificate is exposed to a malicious payload — even briefly — standard computer security incident response requires treating it as compromised regardless of whether exfiltration can be confirmed.

OpenAI's analysis concluded that the signing certificate was "likely not successfully exfiltrated" due to the timing of payload execution, certificate injection sequencing, and other mitigating factors. However, the word "likely" is doing significant work in that sentence. The company correctly chose to revoke and rotate the certificate rather than rely on probabilistic analysis — because if the certificate had been silently stolen and used to sign malicious software, that software would appear to macOS as a fully trusted, legitimate OpenAI application.

The Axios and Trivy supply chain attacks of March 2026 represent the most significant open-source ecosystem compromise since the XZ Utils backdoor in 2024. Google has warned that "hundreds of thousands of stolen secrets" could be circulating as a result, with potential consequences including ransomware deployment, SaaS environment compromise, cryptocurrency theft, and further cascading supply chain attacks.

Two confirmed high-profile victims of the Trivy supply chain attack — which ran parallel to the Axios compromise — are AI data training startup Mercor and the European Commission. The LAPSUS$ extortion group claims to have exfiltrated approximately 4TB of data from Mercor, causing Meta to pause its work with the company. CERT-EU confirmed that threat actors used stolen AWS credentials from the Trivy attack to exfiltrate data from the Commission's cloud environment, affecting websites for up to 71 clients of Europa's web hosting service and outbound email communications. ShinyHunters has since publicly released that exfiltrated data on its dark web leak site.

GitGuardian's analysis found that 474 public repositories executed malicious code from the compromised Trivy GitHub Actions workflow, and 1,750 Python packages were configured to automatically pull the poisoned versions. TeamPCP, the cybercriminal group behind the Trivy attack and identified as CVE-2026-33634, has since pivoted from supply chain operations to monetizing the stolen credentials — partnering with Vect, LAPSUS$, and ShinyHunters while also launching a proprietary ransomware operation called CipherForce. The group reportedly validates stolen credentials using TruffleHog, launches discovery operations within 24 hours of validation, and then executes lateral movement and further data exfiltration.