The TanStack npm supply-chain attack enabled Grafana attackers (TeamPCP) to penetrate GitHub workflows, followed by a failed extortion attempt by CoinbaseCartel.

GitHub was compromised through an infected IDE extension and lost approximately 3,800 internal repositories; the hacker group TeamPCP is offering the data for sale, while simultaneously Microsoft Python packages were infected with malware serving as a dropper for additional malicious software.

The malware authors behind the npm worm Shai-Hulud have published the source code, and the first clones are now appearing.

Microsoft confirms Windows Update error in isolated networks with error code 0x80010002; affected systems cannot download updates from March onwards, with a Known Issue Rollback update to remedy the problem.