TanStack Supply Chain
TanStack Supply Chain is tracked here as a malware family or toolset with 5 Sigma detections spanning 2026. Coverage centers on linux / file_event, linux / process_creation, windows / dns_query +2.
TanStack Supply-Chain Attack DNS Indicators
Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on. The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz. The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.
TanStack Supply-Chain Attack Execution Indicators - Linux
Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.
TanStack Supply-Chain Attack Execution Indicators - Windows
Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath reported on early May 2026.
TanStack Supply-Chain Attack File Creation Indicators - Linux
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
TanStack Supply-Chain Attack File Creation Indicators - Windows
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.