SlowMist: Grafana is suspected to have been attacked, and the attacker may have stolen the private key and implanted malicious code

According to the security alert released published by the chief information security officer @im23pds from Slow Fog, the open-source data visualization tool Grafana appears to have been attacked. The attacker used Gato-X to steal signature keys and infiltrated multiple code repositories by abusing application tokens. Preliminary analysis suggests that the attacker might have injected JavaScript code by forging malicious branch names to steal sensitive information, with targets including generating high-privilege GitHub tokens using tibdex/github-app-token, tampering with the grafana/grafana repository, and implantinganting a covert backdoor. Slow Fog warns users to remain vigilant.