OpenAI recently released a security statement, acknowledging that its products were affected by a supply chain attack, involving the third-party library Axios, which is widely used among developers.
The good news is that OpenAI has not found any evidence of user data being stolen, internal systems being compromised, or software code being tampered with. Nevertheless, they have taken proactive measures, updating the security certification of the macOS application and clearly urging users to upgrade the app to the latest version as soon as possible to close potential security vulnerabilities. The upgrade process is simple, and can be done through in-app notifications or official channels.
The origin of the incident dates back to last week. The Axios account hosted on the npm platform was hijacked by hackers, who secretly implanted malicious programs into the code and altered the registered email address of the developer account, thereby cutting off the original owner's recovery path. The ultimate goal of the entire attack chain was to gain control of the victim's device.
This type of supply chain attack is dangerous precisely because of its secrecy - developers reference libraries they trust, but are unaware that they have been tampered with, and downstream users are completely unprepared.
For users of ChatGPT or other OpenAI applications on macOS, the most important thing to do right now is simple: open the application and make sure you are using the latest version.
