[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqjAA6iGMk6tJtCbU7tE6qrb4OUWOSkRzCn0cLzX7Thk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":18,"created_at":19,"published_at":20,"article":21,"tags":25,"podcasts":38,"controls":39},"b6364eaf-ef88-40cf-942e-73c952594bd8","supply-chain-attack-compromises-openais-code-signing-process","1cd91beb-3846-4be5-8885-5acdec6f32b6","Supply Chain Attack Compromises OpenAI's Code Signing Process","A North Korean threat group compromised the lead maintainer of the popular Axios JavaScript library and injected malware into two versions that were live for three hours in late March. OpenAI's GitHub workflow used the compromised library for signing macOS application certificates, forcing them to revoke affected certificates and require all macOS users to update by May 8. While no user data was accessed, this incident demonstrates how supply chain attacks can impact downstream organizations even when the malicious code has limited exposure time. The attack highlights the critical need for organizations to monitor third-party dependencies and have rapid response procedures for supply chain compromises.","**Immediate actions:**\n- Implement dependency scanning tools to monitor all third-party libraries and components\n- Establish automated alerts for security advisories affecting used dependencies\n- Create emergency procedures for rapidly rotating compromised certificates and credentials\n\n**Long-term improvements:**\n- Implement software bill of materials (SBOM) tracking for all applications and workflows\n- Use dependency pinning and integrity verification for critical build processes\n- Establish vendor risk assessment programs for all third-party software components\n\n**Detection measures:**\n- Deploy runtime application security monitoring to detect anomalous behavior\n- Implement code signing verification processes throughout the development pipeline\n- Monitor GitHub and other repositories for unexpected changes to critical dependencies",[12,13,14,15,16],"CIS Control 2","NIST SP 800-161","NIST Cybersecurity Framework SC-7","SSDF 1.1","ISO 27036",{},"published","2026-04-13T22:10:00.411697+00:00","2026-04-13T22:10:00.269+00:00",{"id":7,"url":22,"slug":23,"title":24},"https:\u002F\u002Fcyberscoop.com\u002Fopenai-axios-supply-chain-attack\u002F","openai-s-mac-apps-need-updates-thanks-to-the-axios-hack-93390c","OpenAI’s Mac apps need updates thanks to the Axios hack",[26,32],{"id":27,"name":28,"slug":29,"description":30,"color":31},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":33,"name":34,"slug":35,"description":36,"color":37},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[40,44,48],{"slug":41,"name":42,"problem":43},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":45,"name":46,"problem":47},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":49,"name":50,"problem":51},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]