… Mistral AI told BleepingComputer that the TeamPCP managed to contaminate some of the company’s software development kit SDK packages. In an advisory published earlier this week, the company said that the breach occurred after a developer device was impacted by the TanStack supply-chain attack. …
… Download Now Related Articles: TeamPCP hackers advertise Mistral AI code repos for sale Official SAP npm packages compromised to steal credentials Shai Hulud attack ships signed malicious TanStack, Mistral npm packages Bitwarden CLI npm package compromised to steal developer credentials Trivy vulne… …
GitHub links repo breach to TanStack npm supply-chain attack By Sergiu Gatlan May 21, 2026 02:54 AM GitHub says the hackers who breached 3,800 internal repositories gained access via a malicious version of the Nx Console VS Code extension, compromised in last week's TanStack npm supply-chain attack… …
… Download Now Related Articles: DAEMON Tools trojanized in supply-chain attack to deploy backdoor Popular node-ipc npm package compromised to steal credentials Shai Hulud attack ships signed malicious TanStack, Mistral npm packages TeamPCP hackers advertise Mistral AI code repos for sale OpenAI conf… …
Grafana breach caused by missed token rotation after TanStack attack By Bill Toulas May 20, 2026 11:46 AM The Grafana data breach was caused by a single GitHub workflow token that slipped through the rotation process following the TanStack npm supply-chain attack last week. …
… "We are investigating unauthorized access to GitHub's internal repositories," GitHub told BleepingComputer when asked for further details. …
… According to TanStack's post-mortem report from TanStack, the attackers chained three vulnerabilities: a risky ‘pull request-target’ workflow, GitHub Actions cache poisoning, and OIDC token theft from runner memory. …
… Download Now Related Articles: New stealthy Quasar Linux malware targets software developers Hackers compromise Axios npm package to drop cross-platform malware Windows 11 and Microsoft Edge hacked at Pwn2Own Berlin 2026 Popular node-ipc npm package compromised to steal credentials Shai Hulud attac… …
… The attacker's current claims of ~3,800 repositories are directionally consistent with our investigation so far." This comes after GitHub told BleepingComputer on Tuesday evening that it was investigating claims of unauthorized access to its internal repositories and added that it has no evidence t… …
… A company spokesperson confirmed to BleepingComputer that the threat actor obtained credentials to the repositories from the Trivy supply-chain attack in March. …