Linux Process Creation: Execution of Bun runner for TanStack supply-chain compromise

title: "Linux Process Creation: Execution of Bun runner for TanStack supply-chain compromise"
id: 0086c860-3c63-498c-ab6c-b520787e5e04
status: experimental
description: This rule identifies Linux process execution consistent with a supply-chain compromise workflow where a Bun runtime is invoked to run a TanStack-specific runner script. It matches a process whose image path ends with '/bun' with a command line containing 'bun', 'run', and 'tanstack_runner.js'. It also optionally flags accompanying payload execution patterns involving a Python3 image launching a /tmp/transformers.pyz archive. The telemetry relies on process creation details such as image path and command-line arguments to connect execution to suspicious installer behavior.
references:
  - https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
  - https://socket.dev/supply-chain-attacks/mini-shai-hulud
  - https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/proc_creation_lnx_malware_tanstack_supply_chain.yml
author: Leonardo Gasparini, Huntrule Team
date: 2026-05-12
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1059.006
  - attack.t1204.002
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection_bun_runner:
    Image|endswith: /bun
    CommandLine|contains|all:
      - bun
      - run
      - tanstack_runner.js
  selection_pypi_payload:
    Image|contains: /python3
    CommandLine|contains: /tmp/transformers.pyz
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e
    type: derived