# OpenAI Rotates macOS Code-Signing Certificates Following Supply Chain Attack on GitHub Actions Workflow


OpenAI has initiated an immediate rotation of its macOS code-signing certificates after discovering that a malicious version of the Axios package was executed within one of its GitHub Actions workflows. The incident represents another high-profile example of how attackers are targeting the software development pipeline itself—not just end applications, but the cryptographic credentials used to authenticate and distribute software across millions of devices.


## The Threat


The attack exploited a compromised npm package to gain execution privileges within OpenAI's CI/CD infrastructure. The malicious Axios package was designed to execute arbitrary code during the build and deployment process, potentially giving attackers access to sensitive development infrastructure, including code-signing certificates used to sign macOS applications.


Code-signing certificates are among the most valuable assets in a software publisher's security arsenal. They cryptographically attest that software is legitimate and unmodified, creating a chain of trust between developers and end users. If an attacker obtains these certificates, they can:


  • Sign malicious software that appears to come from the legitimate publisher
  • Bypass security mechanisms like macOS Gatekeeper, which trusts software from known developers
  • Distribute trojanized versions of legitimate applications to unsuspecting users
  • Persist for extended periods before detection, as users trust the publisher's signature

    • OpenAI's swift response to rotate these credentials limits the window of exposure, but the incident raises critical questions about supply chain security in modern software development.


    ## Background and Context


    ### The npm Supply Chain Ecosystem


    Axios is a popular JavaScript HTTP client library with millions of weekly downloads, used extensively in web applications and Node.js projects. Like most npm packages, it is maintained and published by developers who rely on the npm registry as the primary distribution mechanism. This centralized dependency ecosystem creates attractive targets for supply chain attackers—compromising a single popular package can potentially affect thousands of downstream projects.


    The npm ecosystem has experienced multiple supply chain attacks in recent years:

  • 2021: The ua-parser-js package was compromised, affecting millions of websites
  • 2022: The colors and faker packages were deliberately sabotaged by their maintainer
  • 2023: Multiple attacks targeted npm packages through account compromises and typosquatting

    • ### Code Signing in macOS Development


    Code signing on macOS serves as the foundation for the platform's security model. Apple's Gatekeeper technology uses code signatures to verify that applications come from known, trusted developers before allowing execution. Developers must maintain their signing certificates with extreme care—loss or compromise of these credentials can undermine the trust relationship with users.


    When OpenAI distributes macOS applications (whether command-line tools, native clients, or system software), these must be signed with valid Apple developer certificates. Users rely on these signatures as evidence that the software is legitimate and hasn't been tampered with by intermediaries or attackers.


    ## Technical Details


    ### Attack Mechanism


    The compromise occurred within GitHub Actions, the CI/CD platform integrated directly into GitHub repositories. OpenAI's development workflows likely included steps that:


    1. Installed npm dependencies, including Axios

    2. Executed build processes that depend on Axios

    3. Signed resulting binaries using the organization's code-signing certificates


    The malicious Axios package appears to have been injected into the npm registry, likely through one of these mechanisms:

  • Package takeover: Compromised maintainer account credentials
  • Typosquatting: A similarly-named package designed to trick dependency resolution
  • Dependency confusion: Taking advantage of private/public package resolution order

    • Once executed within the GitHub Actions environment, the malicious code could enumerate available credentials, including:

  • Environment variables containing secrets or API keys
  • SSH keys stored in the runner environment
  • Code-signing certificates and private keys cached for macOS builds
  • Repository deploy keys granting access to source code

    • ### What Attackers Could Access


    The severity depends on what credentials were available in the compromised workflow environment. In modern CI/CD setups, developers typically store code-signing certificates in several ways:

  • As environment variables (base64-encoded)
  • As files in the runner workspace
  • In CI/CD secret management systems (GitHub Secrets, HashiCorp Vault)
  • Cached from previous authentication steps

    • If the malicious package successfully exfiltrated OpenAI's Apple Developer Certificate and private key, attackers could sign arbitrary macOS software that would be trusted by users' systems—a critical compromise of the distribution supply chain.


    ## Implications for Organizations


    This incident illustrates several critical risks in modern software development:


    ### Supply Chain Vulnerability

  • npm dependencies are largely unvetted by end users; trust flows primarily from the package maintainer
  • Compromised packages execute with full access to the build environment, including secrets and signing credentials
  • Detection delays are common; attackers may maintain access for weeks before discovery

    • ### Code-Signing Trust Erosion

  • A compromised signature loses all security value; users can no longer trust that software claiming to be from OpenAI is actually from OpenAI
  • Revocation mechanisms are limited on macOS; existing signed software remains cached and runnable
  • Recovery requires user action, as applications downloaded from the internet require explicit user approval to run initially

    • ### Broader Ecosystem Risk

    OpenAI's incident serves as a high-profile reminder that even sophisticated organizations with strong security practices are vulnerable to supply chain attacks. Developers across all organizations now must assume that popular npm packages can be compromised at any time.


    ## Recommendations


    ### For OpenAI Users


  • Monitor for suspicious activity on macOS systems that have OpenAI software installed
  • Verify application signatures using macOS tools: codesign -v --deep /path/to/application
  • Update to new versions of OpenAI tools signed with rotated certificates once available
  • Review security logs for any suspicious network activity from OpenAI applications

    • ### For Development Teams


    Immediate Actions:

  • Audit GitHub Actions workflows for npm package dependencies; identify which ones handle sensitive operations
  • Rotate any exposed credentials (API keys, database passwords, deployment tokens)
  • Verify code-signing certificates haven't been misused to sign unauthorized software
  • Review application deployment logs for suspicious signing activity

    • Long-Term Hardening:

  • Implement package verification: Use npm audit, tools like snyk, or Software Composition Analysis (SCA) platforms to monitor for known vulnerabilities
  • Restrict code-signing certificate access: Limit which CI/CD workflows and team members can access signing credentials
  • Use hardware security modules (HSMs) for code-signing private keys in high-security environments
  • Separate build environments: Keep CI/CD credentials isolated from development machines
  • Implement supply chain security: Consider tools like npm ci with locked dependencies and vendored modules for critical projects

    • ### For Security Teams


  • Deploy runtime security monitoring in CI/CD pipelines to detect suspicious credential access or exfiltration
  • Implement code-signing certificate monitoring to detect unauthorized signing activity
  • Establish incident response procedures specifically for code-signing compromise scenarios
  • Conduct supply chain risk assessments of critical npm dependencies
  • Require MFA and strong authentication for npm accounts that maintain critical packages

    • ## Conclusion


    OpenAI's certificate rotation incident underscores that supply chain security requires vigilance at multiple levels: package ecosystem security, credential management, and incident response capabilities. As software becomes increasingly interdependent and automated build systems proliferate, the stakes for securing the development pipeline have never been higher.


    Organizations must treat code-signing credentials with the same rigor as production database passwords—because in many cases, a compromised signature is far more dangerous.