Grafana Confirms TanStack npm Supply Chain Attack Led to GitHub Repository Cloning

Grafana Labs confirmed that a May 11–16 supply-chain attack tied to the “Mini Shai-Hulud” campaign exploited leaked credentials on self‑hosted GitHub runners to clone and exfiltrate private internal repositories, prompting an extortion demand; Grafana rotated credentials, froze code, engaged Mandiant for independent forensics (which found no code tampering), contained the incident with no customer or production impact, and implemented long‑term mitigations such as short‑lived tokens and stricter access controls.