Windows Execution of tanstack_runner.js via bun.exe

title: Windows Execution of tanstack_runner.js via bun.exe
id: 4b6031de-bbad-42c1-8c09-0cd4b7b094c7
status: experimental
description: Identifies Windows process creation where the executed image ends with bun.exe and the command line includes both 'run' and 'tanstack_runner.js'. This can indicate automated execution of a JavaScript runner tied to a supply-chain-style compromise attempt targeting npm packages. The rule relies on process creation telemetry with executable path/filename and full command-line content.
references:
  - https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
  - https://socket.dev/supply-chain-attacks/mini-shai-hulud
  - https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/proc_creation_win_malware_tanstack_supply_chain.yml
author: Leonardo Gasparini, Huntrule Team
date: 2026-05-12
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1204.002
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \bun.exe
    CommandLine|contains|all:
      - run
      - tanstack_runner.js
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 9b4f3d2e-6e8c-5fab-c7d9-2a3b4e5f6a7b
    type: derived