April 13, 2026

OpenAI details impact of North Korea-linked Axios supply chain attack

OpenAI has been impacted by a recent supply chain attack linked to North Korean hackers, affecting the widely used Axios JavaScript HTTP client library. The attack began when the NPM account of a lead Axios maintainer was compromised, leading to the publication of malicious packages that could download a cross-platform remote access Trojan (RAT). OpenAI’s investigation revealed that a malicious version of Axios was inadvertently downloaded during a workflow for signing macOS applications, including its products such as ChatGPT Desktop. Although the company believes its app-signing certificate has not been compromised, it has opted to revoke and rotate the certificate as a safety measure, effective May 8, 2026. Cybersecurity firms have noted the broad impact of the attack, with evidence of compromise found on numerous machines.

Axios: Axios is a widely used open-source promise-based HTTP client library for JavaScript in web browsers and Node.js environments. In late March 2026, attackers compromised a lead maintainer’s NPM account and published two malicious versions that deployed a cross-platform remote access trojan. The packages were detected and removed within hours but affected developer workflows and production systems including OpenAI’s.
OpenAI: OpenAI is an artificial intelligence company that develops large language models and applications including ChatGPT Desktop, Codex, Codex-cli, and Atlas. It was impacted by the recent Axios supply chain attack when a malicious version executed in a GitHub Actions workflow used for macOS app-signing. The company investigated, found no evidence of signing certificate compromise, but rotated it as a precaution with full revocation planned for May 8th, 2026.
UNC1069: UNC1069 is a North Korea-nexus financially motivated threat actor also tracked as CryptoCore or MASAN, active since at least 2018. It primarily targets cryptocurrency sectors but has expanded to software supply chain attacks, including social engineering a Axios maintainer to deploy malicious NPM packages with a RAT. Google Threat Intelligence linked it to this recent Axios incident.
North Korea: North Korea is a nation-state that sponsors cyber threat groups conducting financially motivated attacks and espionage. It has been attributed to the recent supply chain compromise of the Axios NPM package executed by UNC1069. Such operations often involve social engineering and targeting open-source software ecosystems.

Attack Vector: Compromise began with social engineering of an Axios NPM maintainer account, leading to publication of malicious packages via normal update channels.
Industry Response: Cybersecurity firms like Huntress and Wiz analyzed impacts, while OpenAI detailed remediation in a public blog post.
Malware Capability: Malicious Axios versions downloaded a cross-platform RAT operable on Windows, macOS, and Linux for potential credential harvesting and persistence.

Sources