title: TanStack Supply-Chain Attack File Creation Indicators - Linux
id: 2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d
status: experimental
description: Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
references:
- https://www.netskope.com/blog/shai-hulud-style-npm-worm-hits-tanstack
- https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
- https://socket.dev/supply-chain-attacks/mini-shai-hulud
- https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
author: Leonardo Gasparini
date: 2026-05-12
tags:
- attack.initial-access
- attack.t1195.002
- attack.execution
- attack.t1059.007
- attack.persistence
- attack.privilege-escalation
- attack.t1547.004
- detection.emerging-threats
logsource:
category: file_event
product: linux
detection:
selection_malware_files:
TargetFilename|endswith:
- '/router_init.js'
- '/tanstack_runner.js'
selection_persistence_claude_vscode:
TargetFilename|endswith:
- '/.claude/router_runtime.js'
- '/.vscode/router_runtime.js'
selection_pypi_payload:
TargetFilename: '/tmp/transformers.pyz'
condition: 1 of selection_*
falsepositives:
- Unknown
level: medium