Grafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack

TanStack and other major NPM and PyPI projects were targeted by a Mini Shai-Hulud supply chain attack on May 11, deploying self-propagating information-stealing malware. Grafana detected malicious activity tied to the attack and rotated GitHub workflow tokens, but one token was not revoked. The threat actor then accessed Grafana Labs GitHub repositories. Grafana later confirmed a specific workflow previously considered unaffected had been compromised. On May 16, Grafana received a ransom demand, refused payment, hardened GitHub security, and notified law enforcement. The incident scope was limited to Grafana Labs GitHub repositories, including public and private source code and internal operational repositories. No production systems or Grafana Cloud platform were affected, and customers or open source users needed no action.

"Grafana says it detected malicious activity associated with the attack on May 11 and immediately rotated GitHub workflow tokens. Because one token was not revoked, however, the threat actor behind the TanStack attack accessed Grafana's GitHub repositories. "A subsequent review confirmed that a specific GitHub workflow we originally deemed not impacted had, in fact, been compromised," Grafana says."

"On May 16, Grafana received a ransom demand from the attackers, but refused to pay. Simultaneously, it launched additional mitigation efforts, hardened its GitHub posture, and notified law enforcement. "Current findings indicate the scope of this incident is limited to the Grafana Labs GitHub repositories, which include public and private source code along with internal GitHub repos," Grafana says."

"While no customer production systems or operations were affected, the hackers did steal Grafana's codebase, as well as repositories storing internal operational information and other business details. "This includes business contact names and email addresses that would be exchanged in a professional relationship context, not information pulled from or processed through the use of production systems or the Grafana Cloud platform," Grafana says."

"The incident, it explains, did not affect its production systems, nor the Grafana Cloud platform. Furthermore, Grafana says, while its codebase was downloaded, it was not modified, and no action is needed from customers or open source users."

Read at SecurityWeek