Windows Execution of tanstack_runner.js via bun.exe run

title: Windows Execution of tanstack_runner.js via bun.exe run
id: 4b6031de-bbad-42c1-8c09-0cd4b7b094c7
status: experimental
description: This rule identifies Windows process executions where the binary name ends with bun.exe and the command line includes both "run" and "tanstack_runner.js." Such execution patterns can indicate scripts being launched as part of a supply-chain incident or other automated package-related activity. Telemetry relies on Windows process creation events providing the process image path and full command line.
references:
  - https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
  - https://socket.dev/supply-chain-attacks/mini-shai-hulud
  - https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/proc_creation_win_malware_tanstack_supply_chain.yml
author: Leonardo Gasparini, Huntrule Team
date: 2026-05-12
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1204.002
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \bun.exe
    CommandLine|contains|all:
      - run
      - tanstack_runner.js
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 9b4f3d2e-6e8c-5fab-c7d9-2a3b4e5f6a7b
    type: derived