Grafana Labs codebase stolen via missed GitHub token after TanStack supply-chain attack; ransom refused
Observability vendor Grafana Labs disclosed that an attacker used a GitHub workflow token it had failed to rotate after the TanStack npm supply-chain attack to download its public and private source code, then refused the resulting ransom demand.
- Victim
- Grafana Labs