Grafana GitHub Breach Linked to TanStack npm Supply Chain Ransomware

**Grafana Labs disclosed a targeted supply-chain breach detected on May 11, 2026**, stemming from malicious TanStack npm packages that enabled attackers to compromise a CI/CD workflow token and access internal and private GitHub repositories; portions of source code, internal documentation, and business contact data were downloaded and a ransom demand was received on May 16. Grafana rotated automation tokens, audited repository activity, hardened CI/CD pipelines, and is cooperating with law enforcement, noting no impact to production systems or Grafana Cloud and no evidence of code modification.