How GitHub and Grafana were hit by supply chain attacks

Welcome to Runtime! Today: GitHub and Grafana share more details on how hackers stole their code, Google Cloud booted Railway off its infrastructure for no clear reason, and the latest enterprise moves.

Please forward this email to a friend or colleague! If it was forwarded to you, sign up here to get Runtime each week, and if you value independent enterprise tech journalism, click the button below and become a Runtime supporter today.

Layers upon layers

The relentless pace of attacks targeting open-source software package managers in the first half of 2026 is taxing some of the most careful, well-resourced security organizations in enterprise tech. GitHub and Grafana Labs released more details this week on how their code bases were compromised through two separate incidents that can be traced back to the TanStack npm attack from last week, and the eventual fallout of that attack could be much wider than we currently understand.

The reports underscore two truths about defending high-profile targets in the current environment: even well-planned incident-response strategies can fail in the heat of the moment, and all it takes is one bad machine to compromise an entire code base. In Grafana's case, it took nearly a week to realize that its source code was being held for ransom.

• After attackers released another version of the Mini Shai-Hulud worm last Monday night targeting the TanStack developer tool, Grafana's security team "detected the malicious activity" and sprung into action, rotating the GitHub credentials that the attackers were hoping to steal, it said in a blog post.
• However, "a missed token led to the attackers gaining access to our GitHub repositories," and "a subsequent review confirmed that a specific GitHub workflow we originally deemed not impacted had, in fact, been compromised," it said.
• That access allowed the attackers to download Grafana's source code and demand payment for its return over the weekend, which the company (to its credit) refused to do, but no Grafana customers were impacted.

The last thing GitHub needed after a horrendous start to 2026 was a major security incident, but that's what it got after one of its developers downloaded one compromised VS Code extension, and 3,800 internal GitHub repositories flew out the window. And that extension was poisoned after just one of the developers working on the Nx open-source project downloaded a bad TanStack package.

• On Monday, GitHub noticed that one of its employee's computers was behaving strangely and realized that thousands of its internal repositories had been exfiltrated, it said in a blog post.
• Turns out that employee had downloaded a poisoned VS Code extension called Nx Console that was only available in the Visual Studio Marketplace for a mere 18 minutes on Monday.
• And that extension was poisoned because the attackers had managed to steal the GitHub credentials of an Nx developer through the TanStack attack and published the malware along with what appeared on all counts to be an official Nx Console release, Nx project developers said in a post on GitHub.

Grafana has raised $1.1 billion in funding, and GitHub is, well, GitHub, which makes it really scary to consider how developers working with far less resources will be able to detect and respond to these attacks. This could be just the start: "I think we will continue to see these techniques. Threat actors know they work, and they’re running with it," Palo Alto Networks' Nathaniel Quist told Wired.

• One way companies can defend themselves against this type of attack is by taking the "move fast and break things" adage at its word and slowing down, such as not installing new updates or packages until they can be vetted; security companies are getting really good at detecting these malicious packages within minutes of their release, but it only takes one download to set off a chain of chaos.
• The Nx project said it would implement 1950s-style nuclear weapons safety techniques for future updates to Nx Console, requiring that "two admins need to manually approve the release."
• And Grafana plans to "[implement] significant measures to further secure our CI/CD (continuous integration and continuous deployment) pipelines and prevent a recurrence of this type of issue."
• Everybody else, good luck out there.

Derailed

Every business operating on cloud infrastructure knows that outages will happen from time to time, and the ones that are particularly concerned with uptime know they need to have a backup plan to ensure they can continue to provide their services. But it seems fair to say that most of those companies haven't considered the possibility that their cloud provider would lock them out of their servers with no warning, and that's exactly what Google Cloud did to Railway on Tuesday evening.

"Railway experienced a platform-wide service disruption due to Google Cloud incorrectly placing our account in a suspended status," the company said in a blog post Wednesday. Railway, which operates a software development and deployment platform, said it had designed its architecture with outages in mind but "there was still a hard dependency on workload discoverability being tied to the network control plane API that was hosted on the machines running in Google Cloud," it said in the blog post.

Google Cloud has yet to release any details on how exactly this happened, but has not disputed Railway's account of the events. At least it's not as bad as deleting a huge pension fund's entire account.

Enterprise moves

Andrej Karpathy is the new … something at Anthropic, joining the frontier model company's research arm after a legendary engineering career.

Raviv Levi is the new chief product and technology officer at CData, joining the data management company after engineering leadership roles at Sift and Cisco.

The Runtime roundup

The Trump administration announced plans to give quantum computing companies $2 billion with funds from the CHIPS Act in exchange for equity stakes, with IBM set to receive $1 billion to create a foundry for quantum chips.

Workday beat Wall Street estimates for revenue and profit and raised its guidance, sending its stock up 14% in after-hours trading and perhaps putting an end to the SaaSpocalypse.

Zoom pulled off the same trifecta, reporting that paying customers for its Zoom AI product tripled compared to last year, according to Bloomberg.

S. "Soma" Somasegar — partner at Madrona Ventures, longtime Microsoft executive, and one of the nicest people in enterprise tech — died Tuesday at the age of 59.

Thanks for reading — Runtime is off for the holiday weekend, see you Tuesday!