供应链攻击处置：OpenAI 公布其对 TanStack「Mini Shai-Hulud」npm 供应链攻击的回应，说明了保护系统与签名证书（signing certificates）的措施，并解释 macOS 用户为何必须升级
Our response to the TanStack npm supply chain attack
精选评分 74
导读
OpenAI 发布一条安全事件回应，主题是针对 TanStack 的「Mini Shai-Hulud」npm 供应链攻击，它说明了自身为保护系统安全与签名证书所采取的措施，并解释 macOS 用户必须升级的原因。属于第三方包被投毒事件中的当事方披露。
推荐理由
点名具体攻击（Mini Shai-Hulud）、给出签名证书的处置并点名 macOS 用户的行动要求，是可执行的一手安全通报。
主体与标签
#安全/对齐#部署/工程
正文
OpenAI details its response to the TanStack “Mini Shai-Hulud” supply chain attack, outlines protections taken to secure systems and signing certificates, and explains why macOS users must update OpenAI apps by June 12, 2026. Learn what happened, what was affected, and how OpenAI is strengthening defenses against evolving software supply chain threats.