TanStack Supply-Chain Attack DNS Indicators
Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on. The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz. The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
DNS lookup events generated by endpoint monitoring tools.
detection:
selection_attacker_apex:
QueryName: 'git-tanstack.com'
selection_session_exfil:
QueryName: 'filev2.getsession.org'
condition: 1 of selection_*False positive likelihood has not been assessed. Additional context may be needed during triage.
Sub-techniques
Other