Linux file creation indicators for TanStack-related supply-chain runner and persistence files

title: Linux file creation indicators for TanStack-related supply-chain runner and persistence files
id: cdedaed6-a37a-4c79-b2da-e7dc8c588736
status: experimental
description: This rule flags Linux file creation events where the target filename ends with specific JavaScript runner/persistence artifacts (e.g., router_init.js, tanstack_runner.js, and router_runtime.js under .claude/.vscode). It also matches creation of a temporary PyInstaller payload file at /tmp/transformers.pyz. Such patterns matter because supply-chain compromises often drop executable and persistence components to project-hidden locations and temporary directories, leaving identifiable filename-level telemetry. The detection relies on Linux file event logs that include a TargetFilename field.
references:
  - https://www.netskope.com/blog/shai-hulud-style-npm-worm-hits-tanstack
  - https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
  - https://socket.dev/supply-chain-attacks/mini-shai-hulud
  - https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_lnx_malware_tanstack_supply_chain.yml
author: Leonardo Gasparini, Huntrule Team
date: 2026-05-12
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.t1059.007
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.004
  - detection.emerging-threats
logsource:
  category: file_event
  product: linux
detection:
  selection_malware_files:
    TargetFilename|endswith:
      - /router_init.js
      - /tanstack_runner.js
  selection_persistence_claude_vscode:
    TargetFilename|endswith:
      - /.claude/router_runtime.js
      - /.vscode/router_runtime.js
  selection_pypi_payload:
    TargetFilename: /tmp/transformers.pyz
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d
    type: derived