OpenAI Rotates macOS Certs After Supply Chain Attack on Axios Package

OpenAI is taking a proactive stance, rotating its macOS code-signing certificates following a supply chain attack. According to Cyber Threat Intelligence, a malicious version of the Axios package (v1.14.1) was inadvertently downloaded and executed via a GitHub Actions workflow on March 31, 2026. This compromised package had access to OpenAI’s code-signing certificates, which are crucial for verifying the authenticity of its macOS applications like ChatGPT Desktop and Codex.

While OpenAI’s internal investigation, aided by a third-party incident response firm, found no direct evidence that the signing certificates were actually compromised or misused, the company is treating them as potentially exposed. This is a sensible precaution given the sensitive nature of code-signing keys. As a result, all affected OpenAI macOS applications will require users to update to newer versions signed with the freshly rotated certificates. Older versions may cease to function by May 8, 2026.