TLDR Tech / InfoSec
Grafana breach caused by missed token rotation after TanStack attack
Grafana's breach traces to a single GitHub workflow token missed during incident-response rotation after the Shai-Hulud campaign (attributed to TeamPCP) poisoned dozens of TanStack npm packages with credential-stealing code that Grafana's CI/CD consumed on May 1, letting attackers reach private repositories and steal source code plus business contact data, though Grafana confirms no customer production systems were affected and its codebase was not modified.
Read the full story