When a Supply-Chain Attack on npm Becomes a War of Attrition: TanStack, GitHub, and Grafana
The TanStack npm supply-chain attack, delivered via the Shai-Hulud malware campaign by the threat group TeamPCP, is the kind of cascading failure that exposes how brittle the entire developer toolchain has become. What started as compromised npm packages in early May 2026 snowballed into the compromise of 3,800 GitHub internal repositories and a breach of Grafana's own codebase — two of the most consequential security incidents to hit major infrastructure providers in months.
The attack chain is methodical and well-documented. On May 19, Nx developers revealed they were investigating a malicious version of Nx Console 18.95.0 — the official VS Code extension for managing monorepos and multi-project codebases — that had been live on the Visual Studio Marketplace for approximately 18 hours. The extension carried an embedded credential-stealing module designed to harvest secrets from developer environments. But this wasn't an isolated incident; the Nx Console compromise was itself a downstream effect of TeamPCP's earlier compromise of dozens of TanStack and Mistral AI npm packages, which included malicious credential-stealing payloads.
The GitHub breach was direct: an employee installed the compromised Nx Console extension on their development machine, which executed the credential-stealing code inside their environment. This gave TeamPCP access to GitHub's internal systems. GitHub CISO Alexis Wales responded by rotating critical secrets on Monday into Tuesday, prioritizing the highest-impact credentials first. GitHub stated there was no evidence that customer data stored outside the affected repositories had been stolen, and the compromised device had been secured. However, TeamPCP claimed on the Breached forum that they had accessed approximately 4,000 private repositories and were demanding at least $50,000 in ransom.
Grafana's story is, if anything, more instructive. Their CI/CD workflow consumed one of the same compromised TanStack npm packages. The info-stealer module executed within Grafana's GitHub Actions environment, exfiltrating GitHub workflow tokens to TeamPCP. Grafana detected the malicious activity on May 1 and deployed their incident response plan, including rotating GitHub workflow tokens. Here's the critical detail: they rotated a significant number of tokens but missed one. That single unrotated token gave the attackers access to Grafana's private GitHub repositories. Grafana's official update read like a cautionary tale:
"We performed analysis and quickly rotated a significant number of GitHub workflow tokens, but a missed token led to the attackers gaining access to our GitHub repositories." — Grafana
What was stolen from Grafana? Source code, operational information, and business contact names and emails. Grafana stressed that no customer production data was compromised and that their codebase was not modified — downloaded code remains safe. They confirmed they would not pay the ransom. But the fact that a single missed token rotation could undo hours of incident response work is a stark reminder: token rotation is not a silver bullet.
But the damage didn't stop there. TeamPCP used the stolen CI/CD credentials to pivot further, hitting UiPath, Guardrails AI, and OpenSearch
So what does this tell us about the state of software supply-chain security? First, the developer toolchain — npm → CI/CD → IDE extensions → internal repositories — is a single, highly interdependent attack surface. Compromising a handful of popular packages cascaded into infrastructure breaches across multiple major organizations. There was no "line in the sand" where the attack stopped.
Second, incident response is only as strong as its weakest process. Grafana's rapid token rotation was impressive, but a single missed token negated the entire effort. Automated rotation with verification and confirmation is not just a best practice — it's the only thing that works when human error is in the loop. The fact that Grafana caught this and was transparent about it is commendable, but the underlying lesson is that reliance on manual token auditing during a crisis is a design flaw.
Third, the npm ecosystem remains a fragile trust model. Dozens of packages across multiple organizations were hit using the same initial foothold. Open-source projects are critical infrastructure, and when popular libraries like TanStack are compromised, the blast radius is measured in thousands of downstream projects and organizations. The trust model that says "if it's on npm, it's probably fine" is simply no longer viable.
TeamPCP has been persistent across platforms — they've previously attacked PyPI, NPM, GitHub, and Docker. The Shai-Hulud campaign demonstrates methodical supply-chain infiltration across multiple ecosystems. If this is what one group with no apparent state backing can achieve, the threat landscape is far worse than most organizations realize. The question isn't whether the next supply-chain attack will happen — it's which organization will be next on the list.
Comments
Post a Comment