cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

Grafana Says Missed GitHub Token Let Attackers Access Private Repositories

· Original article ↗

Summary

Grafana says attackers used a GitHub workflow token missed during rotation after the TanStack npm supply-chain attack to access private repositories and steal source code. The company reports no customer production systems or data were compromised.

Key points

  • Grafana says its CI/CD workflow consumed a malicious TanStack npm package, whose credential-stealing code exfiltrated GitHub workflow tokens.
  • After detecting malicious activity on May 1, Grafana rotated tokens but missed one; the company says attackers used it to access private repositories.
  • Grafana says attackers stole source code and downloaded operational information, including business contact names and email addresses.
  • Grafana reports that no customer production systems, operations, or data were compromised.
  • The company says its codebase was not modified and that users do not need to take action; it will notify impacted customers if its assessment changes.
  • The article associates the Shai-Hulud campaign with TeamPCP, while the incident details are attributed to Grafana’s investigation and statements.

Article Details

Victim Organization
Grafana Labs
Incident Type
Supply-chain compromise involving malicious TanStack npm packages, theft and misuse of a GitHub workflow token, and access to private repositories
Data Types Exposed
  • Source code
  • Operational and business information
  • Business contact names and email addresses
Operational Impact
Attackers used a missed GitHub workflow token to access private repositories and downloaded source code and operational information. Grafana said its codebase was not modified and that no customer production systems, data, or operations were compromised.
Ransom Or Extortion
Grafana said hackers would not receive a ransom payment; the article does not state whether a ransom was demanded.
Claim Status
confirmed

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainMalicious TanStack npm packages were consumed by Grafana's CI/CD workflow, enabling malware execution in its GitHub environment.

Threat Actors

TeamPCPThe Shai-Hulud malware campaign involved in the supply-chain attack was attributed to TeamPCP; the article does not provide independent confirmation of that attribution.

Malware

Shai-HuludThe incident was tied to the Shai-Hulud malware campaign attributed to TeamPCP, though Grafana says no customer production systems or data were compromised.

Products

GitHubGrafana says its breach stemmed from a single GitHub workflow token that was missed during rotation after the TanStack npm supply-chain attack, allowing attackers to access private repositories and steal source code.npmGrafana says its breach stemmed from a single GitHub workflow token that was missed during rotation after the TanStack npm supply-chain attack, allowing attackers to access private repositories and steal source code.TanStackGrafana says its breach stemmed from a single GitHub workflow token that was missed during rotation after the TanStack npm supply-chain attack, allowing attackers to access private repositories and steal source code.

Related Articles