SpaceX Hires Natural Gas Trader to Meet Growing Energy Needs 
Samsung Shares Tumble 8% as $79 Billion Return Plan Disappoints 
SoftBank Plans Record $6.3 Billion Bond Sale to Fund OpenAI Investments 
Xiaomi Unveils Xring O3 Chip for Flagship Foldable Phone 
Nvidia Eyes Perplexity Investment at $30 Billion Valuation 
Australia’s Big Four Banks Face Mortgage Slowdown as Valuations Draw Scrutiny 
Anthropic IPO Could Challenge SpaceX’s Record $86 Billion Offering 
29 US states are suing Meta. What might it mean for the rest of the world? 
Alibaba Raises $10.2 Billion to Expand AI Infrastructure 
Tokio Marine Eyes Multibillion-Dollar Suncorp Takeover 
OpenAI Tightens AI Safety Monitoring After Security Incidents 
Want to muck around with a real quantum computer? Now you can 
Apple Cuts Over 200 Siri, Vision Pro Jobs in AI Shift 
New Zealand Moves to Ban Social Media for Children Under 16 
Nvidia AI Server Prices Set to Rise as Memory Costs Surge 
Hanmi Pharm Soars 30% on $2.3 Billion Genentech Obesity Drug Deal 
TikTok, DOJ Reach $400 Million Children’s Privacy Settlement 
Add as a preferred source on Google
OpenAI confirmed on Wednesday that it found no evidence suggesting user data was compromised following a security incident linked to the TanStack npm package, a widely used open-source JavaScript library. The issue stemmed from a supply-chain attack targeting the npm ecosystem, raising concerns across the cybersecurity and developer communities.
The company stated that after conducting an internal investigation, there were no signs that ChatGPT user information or internal systems were accessed through the compromised dependency. OpenAI emphasized that security teams acted quickly to assess potential risks and monitor affected environments after reports of the malicious package surfaced online.
Supply-chain attacks have become an increasing threat in the software industry because attackers exploit trusted third-party libraries to distribute malicious code. In this case, the compromised TanStack npm package reportedly contained unauthorized modifications designed to collect sensitive information from developers or applications using the infected version.
OpenAI reassured users that its infrastructure and customer data remained secure throughout the incident. The company also highlighted the importance of proactive monitoring, dependency verification, and rapid response procedures to reduce risks associated with open-source software vulnerabilities.
Cybersecurity experts warn that attacks targeting npm packages and other software repositories are becoming more sophisticated as threat actors look for indirect ways to infiltrate organizations. Developers are encouraged to regularly audit dependencies, use trusted package versions, enable multi-factor authentication, and implement automated security scanning tools to detect suspicious activity early.
The incident serves as another reminder of the growing importance of software supply-chain security in modern development environments. While OpenAI reported no evidence of unauthorized access or data exposure, the event highlights the broader risks organizations face when relying on third-party open-source tools and libraries.
