A 12.7M-Download npm Package Got Worm'd — and Today It's Forcing You to Re-Update Your ChatGPT Desktop App. Here's the Supply-Chain Lesson.
A JavaScript routing library got compromised last month, and the bill is landing on your Mac today. OpenAI is fully revoking its old macOS signing certificate on June 12 (that's today) which means any ChatGPT, Codex, or Sora desktop app still signed with the previous certificate gets blocked from launching by macOS until you update it. The reason that certificate is being burned traces back to an npm package most developers have never thought about: @tanstack/react-router, which pulls more than 12.7 million downloads a week.
If you don't see the line connecting those two things, that's exactly the point of this post. The distance between "a dependency three levels down got compromised" and "my AI tools won't open this morning" turned out to be a lot shorter than anyone assumed.
What actually happened
In May, TanStack (a very widely used set of open-source libraries) got hit as part of a supply-chain campaign that's been going by the name Mini Shai-Hulud. An attacker published 84 malicious versions across 42 @tanstack/* packages. The technique was nasty: it abused GitHub Actions' pull_request_target "Pwn Request" pattern, poisoned the Actions cache across the fork-to-base trust boundary, and pulled an OIDC token straight out of the runner's memory. In plain terms, the attacker got the packages to publish themselves through the project's own legitimate automation, with no stolen password anywhere in the chain.
The payload behaved like a worm: steal credentials, use them to reach more repos, republish to spread. And it didn't stay in indie-developer land. OpenAI confirmed two employee devices in its corporate environment were impacted, and that a limited amount of credential material was exfiltrated from a small set of internal repositories those two employees could reach. OpenAI says nothing else was taken.
The certificate revocation is the cleanup. Because credentials were potentially exposed, OpenAI is re-signing all of its applications with new certificates and killing the old one today. The practical effect for you: if you're running an OpenAI desktop app that hasn't updated, macOS will refuse to launch it after the revocation, and you'll need to grab the re-signed version.
The part everyone gets wrong
The easy takeaway here is "npm is a dumpster fire, be careful what you install." That's true and useless. You already knew npm has a supply-chain problem, and you're not going to stop using JavaScript.
The takeaway that's actually worth something is about blast radius. This compromise started in a routing library and ended at a certificate that controls whether your AI tools open. Every link in that chain was invisible to you. You didn't install @tanstack/react-router; OpenAI's tooling did, somewhere, transitively. You didn't approve the OIDC publishing flow that got abused; it was a sane-looking default in someone else's CI. And "trusted publishing" (the OIDC-based mechanism that was supposed to make package publishing more secure than long-lived tokens) is precisely what the attacker rode, because a token minted by trusted automation is still a token if you can read it out of memory.
So the lesson isn't "audit npm harder." It's that your AI toolchain is a software supply chain, and you have almost zero visibility into it. The desktop app you treat as a finished product is a tower of dependencies maintained by people you'll never meet, and a compromise anywhere in that tower can reach down and break your morning. That's not a reason to panic. It's a reason to stop treating "I just use the app" as if it removes you from the dependency graph. It doesn't.
The 15-minute move this Saturday
This is a security story, and it happens to land going into a weekend, so here's the small, boring, do-it-once checklist.
Update your vendor desktop apps now, not just OpenAI's. If one major vendor got caught in this campaign and had to rotate certificates, treat it as a prompt to pull the latest signed builds of every AI desktop tool you run, because the campaign hit more than 160 packages across multiple ecosystems and the full downstream list isn't something any of us can see.
Then spend ten minutes on your own dependency hygiene, because the same attack class is coming for projects smaller than OpenAI's. Commit a lockfile and treat it as a security boundary, not a build artifact: pinned, reviewed, and not blindly regenerated. Turn off install scripts you don't need; npm lets you set ignore-scripts, and a huge share of these worms fire from a preinstall or postinstall hook that runs before any of your code does. And if you run CI that can publish packages, look hard at whether a pull request from a fork can reach your secrets or your runner, because that fork-to-base trust boundary is where this one lived.
None of that is exotic. It's the security equivalent of locking your front door. The reason to do it this weekend specifically is that you've got a concrete, dated reminder sitting in your dock: an app that won't open until you update it.
The honest counter-take
I don't want to oversell your personal exposure. The odds that you, specifically, had @tanstack/react-router compromise your machine in this exact window are low, and OpenAI's disclosure suggests the damage even at a high-value target was contained to credential material from a couple of devices, not a catastrophe. Supply-chain fear can tip into a kind of learned helplessness where you assume everything's poisoned and do nothing, which is worse than picking the two or three controls that actually matter and shipping them.
So calibrate. This isn't "the sky is falling." It's "the abstract risk you've been ignoring just produced a visible, dated consequence on consumer software from one of the most resourced companies in the field." That's the useful version of a wake-up call: specific enough to act on, not so scary you freeze.
What I'd actually do
Update every AI desktop app you run today, including the OpenAI ones before the certificate revocation locks the old builds. Then, this weekend, do the three-item hygiene pass on your own projects: commit and respect your lockfiles, disable install scripts you don't need, and check that fork PRs can't touch your CI secrets. That's a couple of hours total, most of it one-time. The thing to carry forward isn't fear of npm. It's the mental model that "I just use the app" was never true. You use the app and everything underneath it, and today is the day that stopped being abstract.
Author
Lukas
@lukcombinator