Grafana Confirms TanStack npm Supply Chain Ransom Incident Hit GitHub Environment

Grafana Labs published a post-incident review of a May 2026 TanStack npm supply-chain ransom attack in which actors exploiting a self-hosted GitHub Actions runner and an overlooked credential exfiltrated repository contents and issued a ransom demand; Grafana engaged Mandiant for a forensic review, declared the compromise contained to its GitHub environment, found no evidence of customer data compromise or code tampering, and performed extensive remediation and security changes.