The TanStack npm supply-chain attack enabled Grafana attackers (TeamPCP) to penetrate GitHub workflows, followed by a failed extortion attempt by CoinbaseCartel.

GitHub was compromised through an infected IDE extension and lost approximately 3,800 internal repositories; the hacker group TeamPCP is offering the data for sale, while simultaneously Microsoft Python packages were infected with malware serving as a dropper for additional malicious software.