--- title: Axios supply chain attack hits OpenAI's signing... description: A North Korean-attributed attack compromised the Axios npm package, exposing OpenAI's macOS code-signing pipeline for ChatGPT Desktop, Codex, and Atlas —... canonical: https://daily.dev/posts/axios-supply-chain-attack-hits-openai-s-signing-pipeline-cpuid-serves-malware-for-six-hours-hqqjsoen1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Axios supply chain attack hits OpenAI's signing pipeline, CPUID serves malware for six hours | daily.dev og:description: A North Korean-attributed attack compromised the Axios npm package, exposing OpenAI's macOS code-signing pipeline for ChatGPT Desktop, Codex, and Atlas —... og:url: https://daily.dev/posts/axios-supply-chain-attack-hits-openai-s-signing-pipeline-cpuid-serves-malware-for-six-hours-hqqjsoen1 og:image: https://api.daily.dev/og/posts/HQqJsoen1.png og:image:alt: Axios supply chain attack hits OpenAI's signing pipeline, CPUID serves malware for six hours og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Axios supply chain attack hits OpenAI's signing pipeline, CPUID serves malware for six hours **[Backend Digest](https://daily.dev/sources/backend_digest)** · 6 min read · 1 upvotes · 0 comments ## Summary A North Korean-attributed attack compromised the Axios npm package, exposing OpenAI's macOS code-signing pipeline for ChatGPT Desktop, Codex, and Atlas — certificates were revoked and users must update by May 8. Separately, CPUID's website served trojanized HWMonitor and CPU-Z downloads for ~6 hours after attackers hijacked backend download links. Storm-1175 is deploying Medusa ransomware within 24 hours of vulnerability disclosure across Exchange, Ivanti, and GoAnywhere MFT. Microsoft's driver signing process locked out VeraCrypt, WireGuard, and others with no appeals path until media pressure forced resolution. Additional coverage includes a Grafana prompt injection, a Claude source code leak, Ubuntu 26.04 LTS security baseline, a Bluesky outage post-mortem caused by unbounded goroutine spawning, and CISA KEV data showing 88% of weaponized vulnerabilities are remediated slower than they are exploited. ## Content **TLDR:** A North Korean-attributed attack on the Axios npm package compromised OpenAI's macOS code-signing workflow after a CI pipeline pulled the malicious version via a floating tag. Separately, the CPUID website served trojanized downloads for roughly six hours after attackers hijacked backend download links rather than the binaries themselves. Storm-1175 is deploying Medusa ransomware within 24 hours of vulnerability disclosure, sometimes before patches exist. The week's theme is uncomfortable: supply chain hygiene and patch velocity are both failing at the same time. --- ## Axios npm compromise reached OpenAI's macOS signing pipeline On March 30, attackers hijacked the Axios maintainer's npm account and published two malicious versions — 1.14.1 and 0.30.4 — carrying a remote access trojan via a phantom dependency with a postinstall hook. The malicious versions were live for about 3.5 hours before npm pulled them, but that was long enough: OpenAI's macOS app-signing GitHub Actions workflow pulled 1.14.1 automatically because it referenced a floating tag with no minimum release age check. The signing certificates for ChatGPT Desktop, Codex, and Atlas were exposed. OpenAI revoked and rotated the certificates and set a May 8 deadline for users to update. If you're running Axios in CI, pin to 1.14.0 or earlier, drop `plain-crypto-js` if it appears in your tree, and switch to `npm ci --ignore-scripts`. ## CPUID website served malware through hijacked download links On April 9-10, attackers compromised CPUID's backend API controlling download links — not the signed binaries themselves — and swapped in malicious installers for HWMonitor and CPU-Z for about six hours. The payload is sophisticated: in-memory PowerShell execution, a fake CRYPTBASE.dll for C2 contact, .NET payload compiled on the victim machine, EDR evasion via NTDLL proxying, and HVNC for remote access. The CPU-Z variant likely compromises on install; the HWMonitor variant may require running the program. Infrastructure analysis ties this to the same group that hit FileZilla users last month. If you downloaded either tool from CPUID on April 9-10, rotate browser credentials and session tokens and assume compromise. ## Storm-1175 weaponizes vulnerabilities within 24 hours of disclosure Microsoft Threat Intelligence has linked Storm-1175 to Medusa ransomware attacks that move from initial access to data exfiltration in under 24 hours. The group has exploited over 16 vulnerabilities across products including Exchange, Ivanti, and GoAnywhere MFT — in some cases before a patch exists. The playbook is consistent: RMM tools for lateral movement, Impacket for credential dumping, Rclone for exfiltration, and Defender registry tampering to let Medusa run. The hard recommendation from Microsoft is to patch immediately on disclosure, not on your usual cycle. That's easy to say and genuinely difficult to operationalize, but the data from a separate analysis of one billion CISA KEV remediation records makes the stakes concrete: 88% of tracked weaponized vulnerabilities were remediated slower than they were exploited. ## Microsoft's driver signing process locked out VeraCrypt, WireGuard, and others In October 2025, Microsoft's mandatory Windows Hardware Program account verification suspended developer accounts for VeraCrypt, WireGuard, Windscribe, and MemTest86 with no clear explanation, no appeals path, and no human escalation route. Without a signed driver, you can't ship Windows builds — no security patches, nothing. Windscribe's account was suspended despite eight years of verified standing. Accounts were only restored after media coverage prompted executive intervention from Scott Hanselman and Pavan Davuluri. The structural problem remains: Microsoft controls kernel driver signing with no alternative path, and a single opaque administrative process can halt security-critical software indefinitely. Large ISVs with account managers get a phone call. Open source maintainers got Twitter. --- ## Also notable - **Grafana prompt injection (GrafanaGhost):** Noma researchers found an indirect prompt injection in Grafana's AI assistant that could exfiltrate data via malicious instructions embedded in attacker-controlled pages using protocol-relative URLs; Grafana patched the Markdown image renderer but disputes the severity, claiming significant user interaction was required. - **Apple patches DarkSword for iOS 18:** Apple extended patches for the DarkSword exploit chain to iOS 18 users who hadn't upgraded to iOS 26, breaking its usual precedent — the patch came roughly a week after the exploit leaked to GitHub on March 22. - **Claude source code leak and supply chain cluster:** A 10-day window of incidents including attacks on Trivy, Axios, KICS, LiteLLM, and Anthropic's accidental leak of 500,000+ lines of Claude Code source code to npm highlights that misconfigured GitHub Actions and compromised maintainer accounts are the actual attack surface, not zero-days. - **Datadog open-sources AI-native SAST:** The tool uses LLMs for context-dependent vulnerability detection, benchmarking at 86% true positive rate for SQL injection versus 63% for traditional SAST, with incremental rescanning to manage cost. - **Ubuntu 26.04 LTS security baseline:** Ships with TPM-backed FDE in GA, AMD SEV-SNP and Intel TDX support, post-quantum defaults via OpenSSH 10.2 with hybrid mlkem768x25519, Rust-based sudo-rs and rust-coreutils as defaults, and TLS 1.0/1.1 disabled in Apache and Nginx. - **Bluesky 8-hour outage post-mortem:** A missing `errgroup.SetLimit` call in a batch RPC handler allowed 15-20k URI batches to spawn tens of thousands of goroutines, exhausting TCP ephemeral ports via memcached connection churn and triggering a GC death spiral; the band-aid was randomizing loopback source IPs to expand port space. - **Databricks Lakebase database branching:** Copy-on-write Postgres branches provisioned in seconds regardless of database size, with non-production branches auto-scaling to zero — practical for per-PR and per-CI-run isolation. - **Dynatrace acquires Bindplane:** The deal targets pre-processing and routing telemetry at the edge before it hits the backend, with Bindplane remaining vendor-agnostic post-acquisition. - **Cloudflare crosses 500 Tbps:** 330+ cities across 125+ countries, with autonomous DDoS mitigation via XDP and eBPF propagating rules globally within seconds — demonstrated absorbing a 31.4 Tbps attack in 2025. - **npm package metadata scaling problem:** Axios returns 37MB of JSON for all version metadata; Renovate hit npm's 100MB hard limit at 10,451 versions; NuGet V3 and Docker Hub are the only major registries that paginate server-side. - **Google open-sources Scion:** An experimental multi-agent orchestration testbed that gives each agent its own container, Git worktree, and credentials, supporting Claude Code, Gemini CLI, and OpenAI Codex as runtimes — still alpha. - **CISA KEV remediation analysis:** Across one billion records from 10,000 organizations over four years, the percentage of critical vulnerabilities still open at Day 7 worsened from 56% to 63% despite teams closing 6.5x more tickets; time-to-exploit has collapsed to negative seven days on average. ## Similar posts on daily.dev - [Two different attackers poisoned popular open source tools](https://daily.dev/posts/two-different-attackers-poisoned-popular-open-source-tools-p4gnqzolb) · The Register · 2 upvotes · 0 comments - [North Korean Hackers Suspected in Supply Chain Attack on Popular Axios Project](https://daily.dev/posts/north-korean-hackers-suspected-in-supply-chain-attack-on-popular-axios-project-zqfdplgvt) · DevOps.com · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#ransomware](https://daily.dev/tags/ransomware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/axios-supply-chain-attack-hits-openai-s-signing-pipeline-cpuid-serves-malware-for-six-hours-hqqjsoen1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/axios-supply-chain-attack-hits-openai-s-signing-pipeline-cpuid-serves-malware-for-six-hours-hqqjsoen1","headline":"Axios supply chain attack hits OpenAI's signing pipeline, CPUID serves malware for six hours","text":"A North Korean-attributed attack compromised the Axios npm package, exposing OpenAI's macOS code-signing pipeline for ChatGPT Desktop, Codex, and Atlas — certificates were revoked and users must update by May 8. Separately, CPUID's website served trojanized HWMonitor and CPU-Z downloads for ~6 hours after attackers hijacked backend download links. Storm-1175 is deploying Medusa ransomware within 24 hours of vulnerability disclosure across Exchange, Ivanti, and GoAnywhere MFT. Microsoft's driver signing process locked out VeraCrypt, WireGuard, and others with no appeals path until media pressure forced resolution. Additional coverage includes a Grafana prompt injection, a Claude source code leak, Ubuntu 26.04 LTS security baseline, a Bluesky outage post-mortem caused by unbounded goroutine spawning, and CISA KEV data showing 88% of weaponized vulnerabilities are remediated slower than they are exploited.","url":"https://daily.dev/posts/axios-supply-chain-attack-hits-openai-s-signing-pipeline-cpuid-serves-malware-for-six-hours-hqqjsoen1","datePublished":"2026-04-11T04:19:26.769Z","dateModified":"2026-04-11T04:19:47.575Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"Axios supply chain attack hits OpenAI's signing pipeline, CPUID serves malware for six hours"}]} ```