OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident

OpenAI revoked its macOS application signing certificate after discovering it was exposed during a malicious Axios npm package supply chain attack in March 2026.

• •OpenAI's GitHub Actions workflow downloaded Axios 1.14.1 containing a malicious backdoor called WAVESHAPER.V2, but analysis suggests the signing certificate was not successfully exfiltrated due to execution timing and mitigating factors.
• •The compromised certificate will be revoked by May 8, 2026, and older versions of ChatGPT Desktop, Codex, and Atlas will no longer receive updates or security support after that date.
• •The Axios attack was attributed to North Korean hacking group UNC1069 and was part of a broader March supply chain campaign that also compromised Trivy vulnerability scanner and multiple Python packages including LiteLLM and Telnyx.
• •TeamPCP orchestrated the Trivy attack using stolen credentials to deploy CanisterWorm malware and is now monetizing harvested credentials with other cybercriminal groups inclu