GitHub says the breach of roughly 3,800 internal repositories was tied to the wider TanStack npm supply-chain attack.