On September 18, 2026, CrowdSec revealed that an attacker copied about 170 private GitHub repositories in May using the account of a former employee whose access had never been revoked. The initial compromise came from TanStack’s malicious npm packages, which also hit Mistral AI and OpenAI.
On August 20, 2026, GitHub’s CTO published the post-mortem for the August 17 outage: 7 hours and 47 minutes of downtime caused by an infrastructure component that failed to scale with load, as monthly commits climbed from 1.4 to 2.9 billion since April. The lesson for SRE teams fits in two words: retry budgets.
From TanStack to Trellix via GitHub Megalodon, the five biggest supply chain attacks of 2026 prove your attack surface extends to every npm install. Third-party risk management must become continuous — the annual questionnaire is dead.
On March 17, 2026, GitHub Enterprise Server 3.20 went GA with two structural security gates: releases are now immutable by default, and secret scanning gains enterprise-wide governance controls. Against a backdrop of escalating supply chain attacks, this release turns the forge into a fortress.
