Grafana Labs Confirms Source Code Theft by 'CoinbaseCartel' Extortion Group Following TanStack Supply Chain Compromise
Grafana Labs Source Code Stolen by 'CoinbaseCartel' in TanStack Supply Chain Attack Fallout
Related Entities(initial)
Threat Actors
Organizations
Products & Tech
Other
Full Report(when first published)
Executive Summary
Grafana Labs, the company behind the popular open-source analytics and visualization platform, has confirmed the theft of its source code and other internal data by an extortion group named "CoinbaseCartel." The breach was a downstream consequence of the "Shai-Hulud" supply chain campaign that had previously compromised the TanStack open-source library. Attackers exploited a single, unrotated workflow token that had been exfiltrated from a Grafana Labs developer environment by a malicious npm package. This incident serves as a powerful case study in the cascading nature of supply chain risk, where a compromise in one upstream dependency (TanStack) directly led to a severe breach in a major downstream project (Grafana Labs). It also underscores the critical importance of comprehensive and meticulous credential rotation following a potential security event.
Threat Overview
The attack on Grafana Labs was not a direct assault but a secondary effect of a broader campaign.
- Initial Vector: The attack originated from the compromise of the TanStack framework. A developer at Grafana Labs presumably used a compromised version of a TanStack package, which contained malware designed to steal secrets from the environment.
- Credential Theft: The malware successfully exfiltrated active workflow tokens from the developer's environment. These tokens are used by CI/CD systems like GitHub Actions to authenticate and perform operations on repositories.
- Incomplete Remediation: Upon learning of the TanStack compromise, Grafana Labs's security team initiated a credential rotation. However, they missed a single token.
- Exploitation: The extortion group "CoinbaseCartel," which had obtained the stolen tokens, used the single valid token to gain access to Grafana Labs's private repositories and exfiltrate source code and other proprietary data.
Technical Analysis
This incident highlights the precision and patience of modern threat actors.
- Upstream Compromise: The attack chain begins with the TanStack compromise, where malicious code was injected into a legitimate package (as seen in the TeamPCP attack).
- Secret Exfiltration: The malicious
postinstallscript in the npm package ran in the Grafana Labs environment, scanned for secrets likeGITHUB_TOKEN, and sent them to the attacker's server. - Delayed Exploitation: The attackers likely tested the stolen tokens over time. When Grafana Labs rotated most of their credentials, the attackers found one that remained active.
- Data Theft: Using the valid token, the "CoinbaseCartel" group authenticated to Grafana Labs's version control system and cloned private repositories containing valuable intellectual property.
MITRE ATT&CK Techniques
T1195.001 - Compromise Software Dependencies and Development Tools: The root cause of the incident.T1078 - Valid Accounts: The attackers used a valid, stolen workflow token to access the repositories.T1552.006 - Group Policy Preferences: The concept of stealing secrets from environment variables in a build environment is analogous.T1041 - Exfiltration Over C2 Channel: The initial theft of the token.T1213.002 - Sharepoint: While specific to Sharepoint, the technique of accessing data from a code collaboration platform like GitHub is the same.T1530 - Data from Cloud Storage Objectis also relevant.
Impact Assessment
- Intellectual Property Theft: The primary impact is the loss of proprietary source code. This code could be analyzed by competitors or attackers to find new vulnerabilities in Grafana's products. The attackers, being an extortion group, will likely try to ransom the data back to Grafana Labs or sell it on the dark web.
- Reputational Damage: As a major player in the developer and DevOps space, a security breach of this nature can damage customer trust.
- Operational Cost: Grafana Labs must now dedicate significant resources to a full-scale incident response, including a more thorough credential rotation, auditing all systems for further compromise, and communicating with customers and partners.
- Systemic Risk: The stolen source code could be weaponized to create exploits targeting the thousands of organizations that use Grafana for monitoring their critical infrastructure, turning this single breach into a widespread threat.
IOCs — Directly from Articles
No specific IOCs such as the missed token, repository names, or attacker infrastructure were mentioned.
Detection & Response
- Detection: Detecting the use of a stolen token can be challenging. Key detection methods include:
- Monitoring for repository access from unusual IP addresses or geographic locations.
- Alerting on large-scale
git cloneorgit pullactivity, especially of multiple repositories by a single token in a short period. - Analyzing access logs for tokens that have been inactive for a long time and suddenly become active.
- Response: Once unauthorized access is detected, the immediate priority is to revoke the compromised token. Following that, a full audit of the attacker's activity is required to determine exactly what was accessed and exfiltrated. Grafana Labs also needs to perform a complete and verified rotation of all potentially related secrets.
Mitigation
- Comprehensive Credential Rotation: Following a potential compromise, the credential rotation process must be absolute and verifiable. Automated scripts should be used to revoke and reissue all potentially affected secrets. A manual checklist is prone to human error, as this incident demonstrates.
- Short-Lived Tokens: Avoid using long-lived, static tokens. CI/CD systems should use short-lived credentials that expire after a few minutes or hours. GitHub Actions' support for OIDC federation with cloud providers is a best practice, as it provides temporary, dynamically generated tokens for each workflow run.
- Token Scopes: When creating access tokens, apply the principle of least privilege. Grant tokens only the specific permissions (e.g., read-only) and repository access they need, rather than broad administrative rights.
- Supply Chain Security Tools: Use tools that scan dependencies for known malicious packages to prevent the initial compromise from happening in the first place.
Timeline of Events
Article Updates
May 26, 2026
Grafana Labs confirms no customer data or services impacted by source code theft. The company publicly refused to pay the ransom demanded by attackers for the stolen code.
Update Sources:
MITRE ATT&CK Mitigations
Privileged Account Management
Implement a rigorous and automated process for rotating all credentials after a potential security incident. Use short-lived tokens instead of static ones.
Continuously audit access logs for version control systems to detect anomalous behavior, such as access from unusual locations or mass downloads.
Multi-factor Authentication
While the token bypasses MFA for the API, ensuring the original developer account was protected by MFA could have prevented the initial credential theft.
Run build processes in isolated environments to prevent a compromised dependency from accessing secrets related to other projects or systems.
D3FEND Defensive Countermeasures
The failure at Grafana Labs was a failure of Authentication Cache Invalidation, or more simply, incomplete credential rotation. The primary mitigation is to have a robust, automated, and verifiable process for this. When a supply chain incident like the TanStack compromise occurs, an organization must assume all secrets in the affected environment are compromised. A 'break-glass' automation script should be triggered that programmatically revokes every single token, key, and password associated with the CI/CD and developer environments. This process should not rely on manual checklists, which are prone to human error. The script should connect to GitHub, AWS, etc., via API and invalidate all active credentials, forcing a complete re-issuing. Regular testing of this 'panic button' is essential to ensure it works when needed.
Applying the principle of Local Account Monitoring to service tokens like the one stolen is a critical detection strategy. Grafana Labs should have had monitoring in place to detect anomalous use of its CI/CD tokens. A SIEM alert should be configured to trigger if a token is used to clone an unusually large number of repositories in a short time, or if a token that has been dormant is suddenly used for heavy activity. Furthermore, correlating access logs with geolocation data could flag a token being used from an IP address or country inconsistent with normal operations. These behavioral analytics can turn a stolen token from a silent key into a noisy alarm bell, alerting the security team to the intrusion.
Strictly scoping access tokens is a powerful preventative measure. The workflow token stolen from the Grafana Labs environment should have been configured with the principle of least privilege. Instead of a long-lived token with broad access, best practice is to use short-lived tokens with tightly restricted scopes. For example, a token used in a build process might only need read access to one specific repository and should expire within an hour. GitHub's OIDC integration allows for the creation of such dynamic, short-lived, and narrowly-scoped credentials automatically for each workflow run. Had such a system been in place, the stolen token would have been expired or useless for accessing the broader set of Grafana's source code, dramatically limiting the blast radius of the initial compromise.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.