Sigma rule: TanStack Supply-Chain Attack File Creation Indicators - Windows

Rule

Title

TanStack Supply-Chain Attack File Creation Indicators - Windows

Status

experimental

Level

medium

Author

Leonardo Gasparini

Date

2026-05-12

File

rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_win_malware_tanstack_supply_chain.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.

Log source

product

windows

category

file_event

Detection

selection_malware_files:
    TargetFilename|endswith:
        - '\router_init.js'
        - '\tanstack_runner.js'
selection_persistence_claude_vscode:
    TargetFilename|endswith:
        - '\.claude\router_runtime.js'
        - '\.vscode\router_runtime.js'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1195.002
• attack.execution
• attack.t1059.007
• attack.persistence
• attack.t1554
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1059.007
• T1195.002
• T1554

References

• https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
• https://socket.dev/supply-chain-attacks/mini-shai-hulud
• https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_win_malware_tanstack_supply_chain.yml