OpenAI has confirmed a supply chain attack involving a malicious NPM package linked to TanStack, which compromised two employee devices. While user data and core code were not affected, attackers accessed internal code repositories, including code-signing certificates for iOS, macOS, and Windows products. To mitigate risks, OpenAI is rotating certificates and requiring macOS users of ChatGPT Desktop, Codex, and Atlas Browser to update their apps by June 12, 2026. After this date, outdated applications will be blocked. The attack exploited a gap in OpenAI's security upgrades, as the compromised devices had not yet synced with the latest security configurations. OpenAI has implemented a nearly one-month grace period for updates to prevent disruption. iOS and Windows clients remain unaffected, and user account credentials are secure.