GitHub links repo breach to TanStack npm supply-chain attack
The chain began with compromised TanStack npm packages. The Hacker News reported that Mini Shai-Hulud used a compromised maintainer account to push malicious AntV npm packages. Hacker News Best (RSS) also reported that TanStack npm packages had been compromised.
On 21 May, BleepingComputer reported that GitHub connected a repository breach to the TanStack supply-chain attack. GitHub confirmed that a malicious VSCode extension enabled the breach of 3,800 repositories.
Reports identified several affected organisations. The Hacker News reported that CrowdSec said the attackers copied 170 private GitHub repositories. BleepingComputer reported that OpenAI confirmed a security breach in the TanStack supply-chain attack. The Hacker News reported that Grafana’s GitHub breach exposed source code. BleepingComputer said a missed token rotation after the TanStack attack caused the Grafana breach.
Assuming the reports are factual, the impact is 0%. CrowdSec, OpenAI, Grafana, repository owners, and users of the compromised npm packages are directly affected through copied private repositories, exposed source code, and breached repository access. The assigned impact score records no broader event-level change.
Watch for GitHub or the affected organisations to publish fuller incident timelines, repository counts, and details of the malicious VSCode extension. Any revision to the reported 3,800 repositories or CrowdSec’s 170 private repositories would change the picture.
An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French
GitHub has confirmed that roughly 3,800 internal repositories were breached after one of its employees installed a malicious VS Code extension. [...]
OpenAI says two employees' devices were breached in the recent TanStack supply chain attack that impacted hundreds of npm and PyPI packages, causing the company to rotate
Grafana Labs, on May 19, 2026, said an investigation into its recent breach found no evidence of customer production systems or operations being compromised. It said the scope of
Cybersecurity researchers have discovered a fresh software supply chain attack campaign that has compromised various npm packages associated with the @antv ecosystem as part of
<a href="https://news.ycombinator.com/item?id=48100706">Comments</a>
The Grafana data breach was caused by a single GitHub workflow token that slipped through the rotation process following the TanStack npm supply-chain attack last week. [...]
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →