On May 11, 2026, a group called TeamPCP released malware hidden inside TanStack, an open-source toolkit that developers across the world use to build web applications. Within six minutes of publication, the malicious code was spreading automatically. Within 48 hours, it had infected over 170 software packages used by organisations ranging from AI companies to enterprise automation vendors.
OpenAI confirmed two of its employees had their work computers hit. Those machines had access to a limited set of internal code repositories, and the attackers did steal some internal credentials from those repositories. OpenAI says no user data was taken, and no core product systems were touched. A third-party forensics firm was brought in to verify this.
This was the second time in six weeks the same class of attack had reached OpenAI. In late March, a similar attack went through a toolkit called Axios, which is used by well over 100 million developers weekly. That first breach exposed the digital certificates OpenAI uses to sign its apps, which is essentially the stamp of authenticity that tells a Mac or Windows computer that an app is genuinely from OpenAI. After that incident, OpenAI rotated those certificates. Now, after the second breach, they have had to rotate them again.
If you use the ChatGPT or Codex desktop app on a Mac, the deadline to update is June 12, 2026. After that date, older versions will stop working. OpenAI has also confirmed that signing keys for Windows, iOS, and Android apps were caught up in the breach, though the Mac situation is the most urgent because of how Apple handles certificate revocation.
What makes TeamPCP genuinely dangerous is how the attack works. They do not break into a company directly. Instead, they find one popular open-source tool, poison it, and let the infection spread automatically from machine to machine by stealing developer credentials and republishing more poisoned packages. This wave hit 42 TanStack packages, 65 UiPath packages, the Mistral AI SDK, and the Guardrails AI toolkit among others. The total download count across all affected packages exceeds 500 million.
This is the fifth Shai-Hulud campaign since September 2025, and each wave has been more technically capable than the last. The May attack was notable for one reason that matters far beyond OpenAI: the malicious packages carried valid digital certificates of their own, meaning standard automated safety checks passed them as legitimate. The defence that the industry had widely adopted was defeated for the first time.
For businesses that are not software companies, the lesson is less technical and more structural. If your organisation uses any software built by developer teams, those teams almost certainly rely on open-source tools like the ones targeted here. You do not need to understand the code to understand the exposure. The question to ask your IT team is simple: which of our internal systems were accessed by developers on or around May 11, and have those systems been checked?
TeamPCP is described by researchers as financially motivated, not state-sponsored. They have previously hit Bitwarden, a password manager used widely in corporate environments, and Aqua Security's Trivy scanner, a tool specifically designed to check for vulnerabilities. Attacking the security tools is a deliberate strategy: if the scanner is compromised, it cannot report the infection.