Linux process execution indicators for TanStack preinstall supply-chain payloads
Flags Linux processes running a Bun-based TanStack runner (and related Python pyz payload execution) indicative of supply-chain compromise.
- Product
- linux
- Category
- process_creation
- Author
- Leonardo Gasparini (SigmaHQ), DRL 1.1
- Published
- 2026-05-12
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process creation patterns consistent with executing a supply-chain payload associated with compromised TanStack npm packages. It looks for a Bun runner invocation (a process whose image ends with /bun and whose command line includes bun run and tanstack_runner.js) or, alternatively, execution of a Python payload stored as /tmp/transformers.pyz. These behaviors matter because supply-chain attacks often rely on preinstall hooks to run attacker-controlled code during dependency installation, and the rule relies on process creation telemetry including image paths and command-line arguments.
Reporting behind it
- socket.devhttps://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
- socket.devhttps://socket.dev/supply-chain-attacks/mini-shai-hulud
- safedep.iohttps://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/proc_creation_lnx_malware_tanstack_supply_chain.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux process execution indicators for TanStack preinstall supply-chain payloads
id: 0086c860-3c63-498c-ab6c-b520787e5e04
status: experimental
description: This rule flags Linux process creation patterns consistent with executing a supply-chain payload associated with compromised TanStack npm packages. It looks for a Bun runner invocation (a process whose image ends with /bun and whose command line includes bun run and tanstack_runner.js) or, alternatively, execution of a Python payload stored as /tmp/transformers.pyz. These behaviors matter because supply-chain attacks often rely on preinstall hooks to run attacker-controlled code during dependency installation, and the rule relies on process creation telemetry including image paths and command-line arguments.
references:
- https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
- https://socket.dev/supply-chain-attacks/mini-shai-hulud
- https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/proc_creation_lnx_malware_tanstack_supply_chain.yml
author: Leonardo Gasparini, Huntrule Team
date: 2026-05-12
tags:
- attack.execution
- attack.t1059.007
- attack.t1059.006
- attack.t1204.002
- detection.emerging-threats
logsource:
category: process_creation
product: linux
detection:
selection_bun_runner:
Image|endswith: /bun
CommandLine|contains|all:
- bun
- run
- tanstack_runner.js
selection_pypi_payload:
Image|contains: /python3
CommandLine|contains: /tmp/transformers.pyz
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e
type: derived