OpenAI rotates certificates after TanStack breach

The "Mini Shai-Hulud" campaign highlights a critical vulnerability in modern CI/CD pipelines where SLSA attestations can be bypassed via build-environment hijacking.

• –Attackers used "Pwn Request" exploits in GitHub Actions to poison TanStack release artifacts with valid signatures.
• –While OpenAI's production systems remain secure, the exfiltration of signing keys from developer workstations posed a significant risk of malware spoofing.
• –The hard June 12 deadline is dictated by macOS security policies, which will block execution for any application signed with the compromised, soon-to-be-revoked certificates.
• –This incident underscores the need for more robust isolation of OIDC tokens and secrets within automated build workflows.