Grafana GitHub Action attempted supply chain attack (Incident)

Grafana Labs detected a supply-chain abuse involving a misconfigured GitHub Action that an attacker exploited by forking a repository, adding a malicious command to exfiltrate environment variables (including credentials), encrypting the data, and deleting the fork; the stolen credentials were then used to access four private repositories. Grafana reported no impact to production systems or customer data, revoked exposed tokens, disabled vulnerable workflows, and performed a full audit.