Loading feed…
Grafana Labs0 Hot0 comments6 min read
Post-incident review for TanStack npm supply chain ransom incident
Grafana Labs published a post-incident review of the TanStack npm supply chain ransom attack that hit them on May 11 via the Mini Shai-Hulud campaign. A missed credential rotation allowed a threat actor to clone their entire repository collection and demand a ransom on May 16. Grafana Labs refused to pay, confirmed no unauthorized access to customer production systems, and verified the Grafana Cloud platform was unaffected. An independent Mandiant investigation corroborated internal findings, finding no evidence of code tampering or repository poisoning. The response included 1,500 security-focused PR reviews, auditing 280 GitHub applications, scanning 1,200 repositories, and a full-engineering security hardening week. Remediation steps included implementing a token broker, fine-grained access controls, short-lived tokens, and compartmentalizing GitHub organizations.
Source: https://grafana.com/blog/post-incident-review-for-tanstack-npm-supply-chain-ransom-incident. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.
