Grafana GitHub Breach: TanStack npm Attack Exposed

Grafana's GitHub repositories were compromised through a malicious npm package targeting the TanStack ecosystem. The Grafana GitHub breach exposed internal source code after attackers weaponized a dependency that many JavaScript projects pull in without a second thought. This is the kind of supply chain attack that keeps security engineers up at night, and for good reason.

How the TanStack npm Package Attack Worked

The attack vector was a poisoned npm package inserted into the TanStack dependency chain. TanStack libraries, including the widely used TanStack Query and TanStack Router, have massive adoption across frontend projects. Attackers published a malicious package that mimicked a legitimate TanStack module, either through typosquatting, dependency confusion, or a direct compromise of the package publishing pipeline.

When Grafana's build or development environment resolved its dependencies, the rogue package executed. From there, the attacker likely used the execution context to exfiltrate credentials or tokens stored in environment variables or local configuration files. GitHub tokens with repository write or read access are a common target in these scenarios. Once stolen, those tokens open the door to source code, CI/CD secrets, and internal tooling.

The fact that this reached Grafana's GitHub means the malicious package ran with enough privilege to access credentials tied to their version control infrastructure. That is not a small footprint.

What Source Code Exposure Actually Means

Losing source code is not just embarrassing. For a project like Grafana, which sits at the center of observability stacks for thousands of companies, exposed source code can reveal proprietary authentication logic, internal API structures, hardcoded staging credentials, and undisclosed vulnerabilities. Attackers who read your source before you patch it have a significant head start.

There is also a secondary risk. If attackers can read the code, they may identify where to plant backdoors in future pull requests or forks. Supply chain attacks rarely stop at reconnaissance.

Protecting Your npm Dependencies and GitHub Tokens

Developers need to treat npm dependencies with the same skepticism they apply to third-party APIs. A few concrete steps that reduce your exposure:

• Lock your dependency tree. Use package-lock.json or yarn.lock and commit them. Regularly audit the diff when they change.
• Enable npm provenance. The npm registry now supports signed provenance for packages. Prefer packages that publish it.
• Scope your GitHub tokens. Any token used in CI should have the minimum required permissions. Fine-grained personal access tokens exist for this reason.
• Rotate credentials after any dependency update. Especially if you cannot fully audit what a new package version does.
• Run dependency audits in CI. Tools like npm audit, Socket.dev, or Snyk catch known-malicious packages before they reach your environment.

You should also scan your web applications for exposure after any supply chain incident. Compromised build pipelines can inject vulnerabilities into your deployed frontend that your code review will never catch.

For more on dependency chain attacks, see our breakdown at /blog/npm-supply-chain-attacks-explained.

What Grafana Users Should Do Now

If you run Grafana in production, watch for the official post-incident report. Grafana's security team will likely publish indicators of compromise and any affected versions. Until then, treat your Grafana instances as potentially running compromised build artifacts if they were built during the exposure window. Monitor outbound traffic from those instances and audit any secrets they have access to.

What is a dependency confusion attack and how does it relate to this breach? Dependency confusion tricks a package manager into downloading a malicious public package instead of a private internal one by exploiting name resolution order. If attackers used this technique against TanStack or Grafana's private packages, any developer running npm install would pull the malicious version automatically.

How do I know if my project pulled the malicious TanStack package? Check your package-lock.json for unexpected version bumps or unfamiliar package hashes. Cross-reference against npm's advisory database and the specific package versions flagged in Grafana's incident report once published.

Should I rotate all GitHub tokens after a supply chain incident like this? Yes. If your CI environment ran affected packages, assume any tokens or credentials accessible in that environment are compromised. Rotate immediately and audit your GitHub audit log for unexpected access patterns.

Run a security scan on your web applications now at VibeWShield to detect vulnerabilities before attackers do.