Grafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack
Grafana this week revealed that the unauthorized access to the Grafana Labs GitHub repositories disclosed earlier this month was the result of the TanStack supply chain attack.
On May 11, TanStack and other high-profile NPM and PyPI projects were hit by a Mini Shai-Hulud supply chain attack that resulted in self-propagating information-stealing malware being deployed on victims’ computers.
Grafana says it detected malicious activity associated with the attack on May 11 and immediately rotated GitHub workflow tokens.
Because one token was not revoked, however, the threat actor behind the TanStack attack accessed Grafana’s GitHub repositories.
“A subsequent review confirmed that a specific GitHub workflow we originally deemed not impacted had, in fact, been compromised,” Grafana says.
On May 16, Grafana received a ransom demand from the attackers, but refused to pay. Simultaneously, it launched additional mitigation efforts, hardened its GitHub posture, and notified law enforcement.
Advertisement. Scroll to continue reading.
...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
