精选理由
供应链攻击是当前最危险的软件安全威胁之一，做开源项目或使用 npm 包的开发者必须了解 OpenAI 的应对策略和更新要求，建议点开查看具体防护措施。
OpenAI 详细回应了针对 TanStack 的“Mini Shai-Hulud”供应链攻击，说明了已采取的保护系统和签名证书的措施。攻击者通过 npm 包传播恶意代码，影响了部分使用相关依赖的项目。OpenAI 强调 macOS 用户必须在 2026 年 6 月 12 日前更新其 OpenAI 应用，以确保签名证书安全。事件暴露了软件供应链的脆弱性，OpenAI 正在加强防御机制以应对此类威胁。
原文 · OpenAI Blog
Our response to the TanStack npm supply chain attack
OpenAI details its response to the TanStack “Mini Shai-Hulud” supply chain attack, outlines protections taken to secure systems and signing certificates, and explains why macOS users must update OpenAI apps by June 12, 2026. Learn what happened, what was affected, and how OpenAI is strengthening defenses against evolving software supply chain threats.
- IT之家05-14 07:14原文