Odaily Planet Daily reports that Grafana Labs posted on X, stating that on May 16, it confirmed a targeted cyberattack. The attackers gained unauthorized access to its GitHub repository and downloaded the codebase via a TanStack npm supply chain attack (Mini Shai-Hulud campaign), followed by a ransom threat.
Investigations indicate that this incident was strictly limited to Grafana Labs’ GitHub environment, with no evidence that customer production systems, operations, or the Grafana Cloud platform were affected. In addition to source code, the downloaded content included some internal business contacts’ names and email addresses. Although the attacker downloaded the code repositories, no alterations were made. Grafana Labs has decided not to pay the ransom and has notified federal law enforcement agencies. Enhanced security measures, including strengthening the CI/CD pipeline, are currently being implemented.