SlowMist: GitHub and Grafana Security Incidents Likely Related to Large-Scale "Dependency-Track" Supply Chain Attack

May 20th update from SlowMist: Several high-profile npm packages—including AntV and Echarts-for-react—and the Python SDK durabletask have fallen victim to the Mini Shai-Hulud supply chain attack. SlowMist’s recommended mitigation steps: - Immediately rotate all your public GitHub, npm, PyPI, and cloud credentials. - Replace affected npm/PyPI packages with verified secure versions, or lock in your dependency versions to avoid further risks. - Isolate any systems that may have been breached, and investigate for cases of credential theft or lateral movement. - Apply security patches to your CI/CD pipeline and review any intrusions into artifacts post-breach. Additional best practices to follow: - Enable real-time monitoring and alerts for suspicious token or key activity. - Roll out stricter dependency review policies and regular supply chain risk checks. - Train teams to verify a package’s authenticity before installing it. - Monitor the dark web and underground markets for any leaks of your organization’s credentials.