Supply-Chain Attack on Axios Threatens Legitimate macOS App Signing
A compromised Axios npm package executed inside OpenAI's macOS app-signing GitHub Actions workflow exposed code-signing certificates, enabling attackers to potentially create seemingly legitimate signed apps without altering source code. This breaks the assumption that signed apps are inherently trustworthy and that CI workflows are safe from supply-chain risks.
OpenAI's workflow downloaded and ran Axios version 1.14.1, which included a malicious dependency linked to the North Korean group UNC1069. The workflow had access to certificates used to sign OpenAI's macOS apps like ChatGPT Desktop and Codex. Although no evidence shows the certificate was stolen or used maliciously, OpenAI revoked and rotated it as a precaution, requiring users to update apps by May 8, 2026.
This incident reveals that executing dependencies within signing workflows can directly compromise the trust chain of signed software. Even without source code changes, attackers can produce malicious apps that appear legitimate, forcing organizations to reconsider how they secure CI pipelines and manage signing credentials.