OpenAI caught in TanStack npm supply chain chaos after employee devices compromised
2026-05-15T19:24:01Z•da09eb654c7dc9068d5da7cd46097a952f50ded518d0b6c2d17b7ee104c49b6a
cache-poisoningcanvas-breachcheckmarxcredential-theftdeveloper-compromisedirty-fragdisk-wipingfragnesiajenkinslinux-kernellocal-privilege-escalationmalwaremicrosoftnpmopenaipatch-tuesdaypublic-exploitransomware','foxconn','data-breach','web-app-breach','cookie-theshai-huludshinyhunterssupply-chaintanstackteamPCPunpatched-vulnerabilityzero-day-leaks
What happened
Multiple high-impact security incidents reported: a TanStack npm cache-poisoning campaign pushed dozens of malicious package versions (credential-theft and disk-wiping payloads), compromising developer machines and leading to limited internal credential exposure at OpenAI after malware reached two staff endpoints. Separately, a new Linux local-root flaw (“Dirty Frag”/Fragnesia) with public exploit code is being circulated with no available patches or CVE; Microsoft published a Patch Tuesday with ~30 critical CVEs; TeamPCP released the Shai‑Hulud worm source on GitHub and continued supply-chain
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- theregister_security
- Record identifier
- da09eb654c7dc9068d5da7cd46097a952f50ded518d0b6c2d17b7ee104c49b6a
- Enrichment time
- 2026-05-15T19:24:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.