[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnkyEJcvMz5xRIoxGyQ9fi8yvkM8drZbfcZzKE17xpvo":3},{"article":4,"iocs":54,"watch_terms":57,"solutions":58,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"1cd91beb-3846-4be5-8885-5acdec6f32b6","OpenAI’s Mac apps need updates thanks to the Axios hack","openai-s-mac-apps-need-updates-thanks-to-the-axios-hack-93390c","The company said a developer tool automatically retrieved a malicious version of the popular open-source library, but insists the integrity of its systems and software were not impacted. The post OpenAI’s Mac apps need updates thanks to the Axios hack appeared first on CyberScoop.","OpenAI discovered that a malicious version of the popular Axios open-source library infected its GitHub workflow used to sign macOS application certificates in late March. A North Korean threat group (UNC1069) compromised Axios's lead maintainer and injected malware into two versions that were live for approximately three hours. Although OpenAI found no evidence of user data access or system compromise, it is revoking and rotating the affected signing certificate and requiring all macOS users to update by May 8 to maintain functionality.","OpenAI's macOS apps require updates after Axios npm library compromised in North Korean supply-chain attack.","https:\u002F\u002Fcyberscoop.com\u002Fopenai-axios-supply-chain-attack\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F04\u002FGettyImages-2268817047.jpg","2026-04-13T20:24:37+00:00","2026-04-13T22:00:24.51171+00:00",9,[17,20,23,25,28,31],{"name":18,"type":19},"OpenAI","vendor",{"name":21,"type":22},"Axios","product",{"name":24,"type":22},"Trivy",{"name":26,"type":27},"npm","technology",{"name":29,"type":30},"UNC1069","threat_actor",{"name":32,"type":19},"Google","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":33,"icon":35,"name":36,"slug":37},null,"Supply Chain","supply-chain",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":43,"value":29,"context":56},"North Korean threat actor group responsible for Axios npm compromise",[32,18,21],{"controls":59,"vendors":139},[60,89,117],{"slug":61,"name":62,"problem":63,"products":64},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":90,"name":91,"problem":92,"products":93},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":111,"vendor_name":32,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"slug":118,"name":119,"problem":120,"products":121},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[122,130,131],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[140],{"slug":111,"name":32,"logo_path":112,"roles":141},[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"supply-chain-attack-compromises-openais-code-signing-process","Supply Chain Attack Compromises OpenAI's Code Signing Process","A North Korean threat group compromised the lead maintainer of the popular Axios JavaScript library and injected malware into two versions that were live for three hours in late March. OpenAI's GitHub workflow used the compromised library for signing macOS application certificates, forcing them to revoke affected certificates and require all macOS users to update by May 8. While no user data was accessed, this incident demonstrates how supply chain attacks can impact downstream organizations even when the malicious code has limited exposure time. The attack highlights the critical need for organizations to monitor third-party dependencies and have rapid response procedures for supply chain compromises.",[148,149,150,151,152],"CIS Control 2","NIST SP 800-161","NIST Cybersecurity Framework SC-7","SSDF 1.1","ISO 27036",{}]