highclosedpatched
OpenAI employee devices hit via TanStack Mini Shai-Hulud wave
› TanStack-related npm packages / OpenAI employee endpoints
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- May 1, 2026
- closed
- May 31, 2026
- CVEs
- none
- sources
- 1
## summary
In May 2026 OpenAI confirmed two employee devices were breached as part of the broader TanStack Mini Shai-Hulud npm supply-chain campaign. OpenAI said customer data, production systems, IP and deployed software were not impacted.
severity: Supply-chain (limited employee impact disclosed)
## affected
- Compromised TanStack package versions in the May wave
## fixed in
no fixed release yet
## news & write-ups[1]
## notes & caveats
Verify primary vendor advisory for exact fixed versions; facts taken from public sources listed in links.
