Linux File Creation Indicators for TanStack Runner and Persistence Components
Alerts on creation of TanStack-style runner/persistence filenames on Linux, including .claude/.vscode router_runtime.js and /tmp/transformers.pyz.
- Product
- linux
- Category
- file_event
- Author
- Leonardo Gasparini (SigmaHQ), DRL 1.1
- Published
- 2026-05-12
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux file creation events where the target filename ends with specific JavaScript runner and persistence component paths (including router_init.js and tanstack_runner.js) or matches a transformer payload path (/tmp/transformers.pyz). Such artifacts can indicate supply-chain compromise staging, where malicious scripts are dropped and persistence scaffolding is created under hidden directories. It relies on file-event telemetry that includes the created file path or target filename to match the defined suffix/path patterns.
Reporting behind it
- netskope.comhttps://www.netskope.com/blog/shai-hulud-style-npm-worm-hits-tanstack
- socket.devhttps://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
- socket.devhttps://socket.dev/supply-chain-attacks/mini-shai-hulud
- safedep.iohttps://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_lnx_malware_tanstack_supply_chain.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux File Creation Indicators for TanStack Runner and Persistence Components
id: cdedaed6-a37a-4c79-b2da-e7dc8c588736
status: experimental
description: This rule flags Linux file creation events where the target filename ends with specific JavaScript runner and persistence component paths (including router_init.js and tanstack_runner.js) or matches a transformer payload path (/tmp/transformers.pyz). Such artifacts can indicate supply-chain compromise staging, where malicious scripts are dropped and persistence scaffolding is created under hidden directories. It relies on file-event telemetry that includes the created file path or target filename to match the defined suffix/path patterns.
references:
- https://www.netskope.com/blog/shai-hulud-style-npm-worm-hits-tanstack
- https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
- https://socket.dev/supply-chain-attacks/mini-shai-hulud
- https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_lnx_malware_tanstack_supply_chain.yml
author: Leonardo Gasparini, Huntrule Team
date: 2026-05-12
tags:
- attack.initial-access
- attack.t1195.002
- attack.execution
- attack.t1059.007
- attack.persistence
- attack.privilege-escalation
- attack.t1547.004
- detection.emerging-threats
logsource:
category: file_event
product: linux
detection:
selection_malware_files:
TargetFilename|endswith:
- /router_init.js
- /tanstack_runner.js
selection_persistence_claude_vscode:
TargetFilename|endswith:
- /.claude/router_runtime.js
- /.vscode/router_runtime.js
selection_pypi_payload:
TargetFilename: /tmp/transformers.pyz
condition: 1 of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d
type: derived