Grafana Labs

Summary

Grafana Labs experienced a breach when attackers exploited a compromised GitHub workflow token stemming from a TanStack supply chain attack that distributed credential‑stealing malware. The intrusion allowed the threat actors to download the company’s codebase and internal operational repositories, including business contact names and email addresses, while no customer production systems or its Cloud platform were affected and no code was altered. After detecting the activity, the company rotated most workflow tokens, but a missed token enabled the access, leading to a ransom demand that was refused. Subsequent review confirmed the scope was limited to the GitHub repositories, and law enforcement was notified.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On May 11, 2026, Grafana Labs detected malicious activity linked to a Mini Shai‑Hulud supply chain attack that had compromised TanStack npm packages earlier that day. The attack involved threat actors, identified as TeamPCP, injecting credential‑stealing malware into dozens of TanStack packages, which when consumed by Grafana’s CI/CD pipelines exfiltrated GitHub workflow tokens. Grafana’s security team observed the activity and immediately began rotating a significant number of those tokens. However, one token was not revoked, allowing the attackers to retain access to the Grafana Labs GitHub environment.

Using the retained token, the threat actors accessed both public and private repositories, downloading the company’s codebase and internal operational information, including business contact names and email addresses exchanged in professional contexts. Grafana confirmed that no customer production systems, Grafana Cloud services, or personal customer data were affected, and that the codebase was not modified. The intrusion was later linked to a ransom note received on May 16, 2026, in which the attackers demanded payment to prevent the leaked source code from being published. Grafana stated it refused to pay the ransom and noted that, at the time of writing, no data had appeared on the leak site associated with the cybercrime group Coinbase Cartel.

Following the discovery, Grafana reset the compromised credentials, hardened its GitHub posture, and launched additional mitigation efforts while notifying law enforcement. The company conducted a forensic analysis and pledged to share further details once the investigation concluded. Grafana also noted that the incident was part of a broader Mini Shai‑Hulud campaign that had impacted other projects such as OpenSearch npm packages, PyPI mistralai and guardrails‑ai, and @squawk packages, with the attackers having compromised TanStack’s own CI/CD pipeline to distribute signed malicious versions. The firm emphasized that no action was required from customers or open‑source users because the source code remained unchanged and no production systems were compromised.

Sources

Sources available to members: 3 sources.