Grafana breach caused by missed token rotation after TanStack attack
2026-05-20T19:23:30Z•48b51f269d90f2b5c8397cfc8514197214c016aad9dd0704a5e82ae4ff9d0840
Arch-LinuxAzureBitLockerChromaDBDrupalFastAPIGitHub-breachGrafanaMicrosoftPinTheftRCESSPR-abuseShai-HuludTanStackTeamPCPYellowKeyartifact-signingcode-signing-abusecritical-updatelocal-privilege-escalationmalicious-vscode-extensionnpmsupply-chaintoken-rotationzero-day
What happened
Multiple high-impact security incidents and supply-chain attacks reported: Grafana suffered a data breach after a GitHub workflow token was not rotated following the TanStack npm supply-chain compromise; GitHub confirmed ~3,800 internal repositories were accessed after an employee installed a malicious VS Code extension and is investigating TeamPCP claims of broader access; a new Shai‑Hulud campaign pushed 600+ malicious npm packages; ChromaDB (FastAPI variant) has a max-severity RCE allowing unauthenticated server compromise; Microsoft disclosed mitigations for the YellowKey BitLocker zero‑dа
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 48b51f269d90f2b5c8397cfc8514197214c016aad9dd0704a5e82ae4ff9d0840
- Enrichment time
- 2026-05-20T19:23:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.