Windows TanStack Supply-Chain File Creation Indicators via router_init.js and router_runtime.js
Alerts on Windows creation of router/tanstack runner and router_runtime files used in a TanStack supply-chain attack pattern.
- Product
- windows
- Category
- file_event
- Author
- Leonardo Gasparini (SigmaHQ), DRL 1.1
- Published
- 2026-05-12
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows file creation events for specific JavaScript artifacts associated with a TanStack-related supply-chain compromise pattern. Attackers may drop or modify local runtime and initialization files to execute malicious code and establish persistence. The detection relies on file event telemetry, specifically the created target filename suffixes matching router_init.js and router_runtime.js under the expected paths.
Reporting behind it
- socket.devhttps://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
- socket.devhttps://socket.dev/supply-chain-attacks/mini-shai-hulud
- safedep.iohttps://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_win_malware_tanstack_supply_chain.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows TanStack Supply-Chain File Creation Indicators via router_init.js and router_runtime.js
id: a94a33ef-4c3a-40a9-8d78-7b7e33de4468
status: experimental
description: This rule flags Windows file creation events for specific JavaScript artifacts associated with a TanStack-related supply-chain compromise pattern. Attackers may drop or modify local runtime and initialization files to execute malicious code and establish persistence. The detection relies on file event telemetry, specifically the created target filename suffixes matching router_init.js and router_runtime.js under the expected paths.
references:
- https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
- https://socket.dev/supply-chain-attacks/mini-shai-hulud
- https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_win_malware_tanstack_supply_chain.yml
author: Leonardo Gasparini, Huntrule Team
date: 2026-05-12
tags:
- attack.initial-access
- attack.t1195.002
- attack.execution
- attack.t1059.007
- attack.persistence
- attack.t1554
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection_malware_files:
TargetFilename|endswith:
- \router_init.js
- \tanstack_runner.js
selection_persistence_claude_vscode:
TargetFilename|endswith:
- \.claude\router_runtime.js
- \.vscode\router_runtime.js
condition: 1 of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 8a3f2c1e-5d7b-4e9a-b6c8-1f2a3d4e5f6a
type: derived