Sigma rule: TanStack Supply-Chain Attack File Creation Indicators - Linux

Rule

Title

TanStack Supply-Chain Attack File Creation Indicators - Linux

Status

experimental

Level

medium

Author

Leonardo Gasparini

Date

2026-05-12

File

rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_lnx_malware_tanstack_supply_chain.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.

Log source

product

linux

category

file_event

Detection

selection_malware_files:
    TargetFilename|endswith:
        - '/router_init.js'
        - '/tanstack_runner.js'
selection_persistence_claude_vscode:
    TargetFilename|endswith:
        - '/.claude/router_runtime.js'
        - '/.vscode/router_runtime.js'
selection_pypi_payload:
    TargetFilename: '/tmp/transformers.pyz'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1195.002
• attack.execution
• attack.t1059.007
• attack.persistence
• attack.privilege-escalation
• attack.t1547.004
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1059.007
• T1195.002
• T1547.004

References

• https://www.netskope.com/blog/shai-hulud-style-npm-worm-hits-tanstack
• https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
• https://socket.dev/supply-chain-attacks/mini-shai-hulud
• https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_lnx_malware_tanstack_supply_chain.yml