TanStack npm Supply Chain Attack Affects OpenAI and AI Ecosystem – May 2026

Impact verdict

High impact. Confirmed impact has expanded from an initial open-source library compromise to a multi-stage supply chain intrusion at a major code-hosting platform (GitHub, with approximately 3,800 internal repositories accessed via a downstream compromised VS Code extension) and reportedly affects multiple AI companies, including OpenAI. This raises exposure across the AI development ecosystem and core developer infrastructure, though confirmed data exfiltration, financial loss, and customer impact details remain undisclosed, and the supply chain nexus to insured loss triggers remains indirect. Potential impact remains high given the scale of GitHub's confirmed internal repository exposure and the expanding campaign scope, pending further disclosure of data loss and containment status.