OpenAI confirmed that a supply chain attack linked to malicious TanStack packages compromised two of its employee devices. This breach exposed sensitive credentials from the company's internal source code repositories. The attackers, part of a group known as TeamPCP, exploited vulnerabilities in the package publishing process to gain access. This incident raises concerns about the security of software supply chains, as it demonstrates how vulnerabilities can lead to significant data exposure. Organizations must be vigilant in monitoring their package management systems to prevent similar attacks.