OpenAI Revokes macOS Certificates After Axios Hack

OpenAI disclosed on April 11, 2026, that it had identified a security incident involving the third-party JavaScript library Axios, part of a broader software supply chain attack that occurred on March 31, 2026. The compromise, attributed to threat actors linked to North Korea, prompted the company to revoke and update security certificates for its macOS applications, requiring all users to install the latest versions to maintain functionality.

The incident stemmed from hackers hijacking an npm account of an Axios maintainer and releasing malicious updates, versions 1.14.1 and 0.30.4. These versions included a hidden dependency, plaincryptojs, which acted as a remote access trojan capable of reconnaissance and persistence across Windows, macOS, and Linux systems before self-destructing to avoid detection. Axios, with over 100 million weekly downloads, is a staple in developer workflows, amplifying the attack's potential reach.

OpenAI's internal build process, reliant on GitHub Actions, automatically incorporated the tainted library during a routine update. This granted temporary access to certificate and notarization materials essential for digitally signing macOS apps, including...