cyber.hendryadrian.com
Cyber Attack & Data Breach · securityonline.info

Grafana Labs Reports Source Code Theft in Mini Shai-Hulud npm Worm Attack

· Original article ↗

Summary

Grafana Labs said a poisoned TanStack npm package led to read-only access to its GitHub repositories and theft of source code and business contact data. It said production and Grafana Cloud were unaffected and has rotated tokens and strengthened controls.

Key points

  • Grafana Labs said the intrusion began May 11, 2026, when a developer pipeline ingested a poisoned upstream npm package associated with TanStack.
  • The company attributed the incident to the Mini Shai-Hulud npm worm campaign.
  • A missed GitHub workflow token allowed attackers to access and clone company repositories.
  • Grafana said the attackers downloaded public and private source code and business contact names and corporate email addresses; access was read-only, and the codebase was not altered.
  • The attackers made a ransom demand on May 16, 2026; Grafana said it refused to negotiate.
  • Grafana said production systems and Grafana Cloud were not affected and that customers and open-source users do not need to take action.
  • The company said it rotated automation and integration tokens, added development-endpoint telemetry, hardened GitHub security, and is auditing commits made since the initial compromise.

Article Details

Victim Organization
Grafana Labs
Incident Type
Supply-chain compromise resulting in read-only access to and theft of GitHub repository data
Incident Date
2026-05-11
Data Types Exposed
  • Public and private source code
  • Internal operational and business data
  • Professional contact names
  • Corporate email addresses
Affected Records
Not disclosed
Affected Data Size
Not disclosed
Operational Impact
Attackers gained read-only access to and cloned company GitHub repositories. Grafana Labs said production environments and Grafana Cloud were not affected, and the codebase was not altered.
Ransom Or Extortion
Attackers demanded a ransom on 2026-05-16 and threatened to leak the stolen intellectual property. Grafana Labs refused to negotiate.
Claim Status
confirmed

Malware

ChainDropGrafana Labs disclosed that a targeted attack tied to the Mini Shai-Hulud npm worm and a poisoned TanStack package led to source code theft and a ransom demand, but its production environments and Grafana Cloud

Vendors

Grafana LabsGrafana Labs disclosed that a targeted attack tied to the Mini Shai-Hulud npm worm and a poisoned TanStack package led to source code theft and a ransom demand, but its production environments and Grafana Cloud

Products

GitHubThe company said the attackers only achieved read-only access to GitHub repositories and business contact data, while Grafana has since rotated tokens and hardened its development security controls.Grafana CloudTanStack package led to source code theft and a ransom demand, but its production environments and Grafana Cloud infrastructure were not affected.TanStackGrafana Labs disclosed that a targeted attack tied to the Mini Shai-Hulud npm worm and a poisoned TanStack package led to source code theft and a ransom demand, but its production environments and Grafana Cloud

Related Articles