Grafana this week revealed that the unauthorized access to the Grafana Labs GitHub repositories disclosed earlier this month was the result of the TanStack supply chain attack.
On May 11, TanStack and other high-profile NPM and PyPI projects were hit by a Mini Shai-Hulud supply chain attack that resulted in self-propagating information-stealing malware being deployed on victims’ computers.
Grafana says it detected malicious activity associated with the attack on May 11 and immediately rotated GitHub workflow tokens.
Because one token was not revoked, however, the threat actor behind the TanStack attack accessed Grafana’s GitHub repositories.
“A subsequent review confirmed that a specific GitHub workflow we originally deemed not impacted had, in fact, been compromised,” Grafana says.
On May 16, Grafana received a ransom demand from the attackers, but refused to pay. Simultaneously, it launched additional mitigation efforts, hardened its GitHub posture, and notified law enforcement.
“Current findings indicate the scope of this incident is limited to the Grafana Labs GitHub repositories, which include public and private source code along with internal GitHub repos,” Grafana says.
While no customer production systems or operations were affected, the hackers did steal Grafana’s codebase, as well as repositories storing internal operational information and other business details.
“This includes business contact names and email addresses that would be exchanged in a professional relationship context, not information pulled from or processed through the use of production systems or the Grafana Cloud platform,” Grafana says.
The incident, it explains, did not affect its production systems, nor the Grafana Cloud platform. Furthermore, Grafana says, while its codebase was downloaded, it was not modified, and no action is needed from customers or open source users.
Related: Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little Visibility
Related: AI-Powered App Attacks Are Faster, More Frequent and Harder to Stop
Related: Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack
