Grafana Codebase Stolen via Unrotated Token in TanStack Supply Chain Attack

Grafana confirmed its GitHub repositories were compromised, leading to the theft of its codebase and other data. The breach, as reported by SecurityWeek, stemmed from an unrotated token that was initially compromised during the broader TanStack supply chain attack.

This incident highlights a critical failure in post-incident hygiene. Even after a supply chain event like TanStack, organizations often miss residual risks. A compromised token, if not immediately revoked and replaced across all integrated services, remains a live threat, providing attackers with persistent access.

Attackers leveraged this oversight to access Grafana’s source code, which can expose intellectual property, reveal architectural weaknesses, and potentially lead to new attack vectors if vulnerabilities are discovered within the code itself. This is a clear indicator that the attacker’s calculus prioritizes leveraging existing access over developing new exploits when possible.