TanStack attack compromises Grafana after missed token rotation

A data breach at Grafana occurred on May 20, 2026, caused by a single GitHub workflow token that slipped through the rotation process following the TanStack npm supply-chain attack last week. The breach was attributed to TeamPCP hackers and involved dozens of infected TanStack packages published on the npm index, compromising developer environments including Grafana's. When the malicious package was released, Grafana's CI/CD workflow consumed it, exfiltrating GitHub workflow tokens to attackers. Despite immediate incident response efforts, one token was missed, allowing attackers to gain access to private repositories and steal source code, operational information, and business contact details without customer impact or ransom payment.