Grafana Labs has disclosed a targeted ransomware-linked breach of its GitHub environment, traced to the broader TanStack npm supply chain compromise associated with the “Mini Shai-Hulud” campaign. The incident, detected on May 11, 2026, involved unauthorized access to internal repositories and culminated in a ransom demand issued on May 16 under threat of data disclosure. Grafana has refused to pay, aligned with FBI guidance, and has engaged federal law enforcement.
How Attackers Got In
The intrusion originated from malicious packages distributed through the TanStack npm ecosystem — part of an ongoing supply chain attack that injected malicious code into development workflows across the industry. Grafana’s engineering team was in the process of remediating the compromised dependencies, but a missed GitHub workflow token during the initial cleanup left a gap that attackers were able to exploit.
The compromised CI/CD workflow token granted attackers access to multiple GitHub repositories, including internal and private projects. A subsequent audit confirmed that the overlooked token had been actively used to exfiltrate repository data after the initial remediation was believed to be complete.
What Was Exposed
Grafana confirmed that attackers were able to download portions of its codebase and internal operational repositories. The exposed data includes:
- Public and private source code repositories
- Internal documentation and operational data
- Business contact information, including names and email addresses
Importantly, Grafana emphasized that no production systems, customer environments, or Grafana Cloud infrastructure were impacted. There is also no evidence that the attackers modified any source code — the breach appears focused on exfiltration rather than sabotage.
The Ransom Demand
On May 16, 2026, Grafana Labs received a ransom demand from the threat actors, who threatened to publicly release the stolen data if payment was not made. The company has refused to comply with the demand, citing FBI guidance that discourages ransom payments due to the lack of guarantees and the risk of encouraging further criminal activity. Grafana is cooperating fully with federal law enforcement agencies investigating the incident.
Incident Response Actions
Following discovery of the breach, Grafana immediately escalated its incident response program. Key actions taken include:
- Rotated all GitHub automation and workflow tokens across the organization
- Conducted a full audit of all repository activity since May 11, 2026
- Implemented enhanced monitoring and logging across all GitHub environments
- Hardened CI/CD pipelines to prevent similar token-based attacks in the future
- Notified federal law enforcement and began cooperating with investigators
The Broader Supply Chain Threat
The Grafana breach is part of a much larger wave of attacks orchestrated through compromised npm packages. The Mini Shai-Hulud campaign — attributed to the TeamPCP threat group — has now affected dozens of high-profile software organizations in 2026, including Aqua Security, Checkmarx, LiteLLM, Telnyx, and Microsoft’s own Python DurableTask SDK. Each breach follows a similar pattern: a developer’s machine or account is compromised through a malicious dependency, and the resulting access to tokens and secrets is weaponized against CI/CD infrastructure.
This attack pattern is particularly dangerous because it exploits the trust model of modern software development. A single compromised npm package installed by a developer can cascade into access to an organization’s entire source code repository and secret store.
What Developers and Security Teams Should Do
The Grafana incident highlights several critical security hardening steps that every organization using GitHub and npm-based CI/CD workflows should implement:
- Audit all workflow tokens: Regularly review which GitHub Actions tokens have repository access and rotate them on a defined schedule
- Enable dependency review: Use GitHub’s dependency review features and lockfiles to detect unexpected package changes before they reach CI pipelines
- Least-privilege access: Grant CI/CD tokens only the minimum permissions they need, avoiding write access to repositories from automated workflows
- Monitor for suspicious token activity: Alert on unusual token usage patterns, particularly access from unexpected IP addresses or at unusual times
- Have an incident response plan: Pre-plan token rotation procedures so that response times are measured in minutes, not hours, when a compromise is detected
Grafana stated that its investigation remains ongoing, with continued analysis of logs, telemetry, and repository activity. A detailed post-incident report will be released upon completion. The company reiterated that no action is currently required from Grafana Cloud customers or open-source users, as there is no indication of downstream compromise.