TanStack Supply-Chain Attack Execution Indicators - Linux
Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_bun_runner:
Image|endswith: '/bun'
CommandLine|contains|all:
- 'bun'
- 'run'
- 'tanstack_runner.js'
selection_pypi_payload:
# observed on guardrails-ai@0.10.1 compromise
Image|contains: '/python3'
CommandLine|contains: '/tmp/transformers.pyz'
condition: 1 of selection_*False positives are unlikely for most environments. High confidence detection.
Tactics
Other