OpenAI says no user data was touched in the TanStack npm worm — Blankdot