Sigma high experimental sigma

TanStack Supply-Chain Attack Execution Indicators - Linux

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.

View Source

Detection Logic

{
  "selection_bun_runner": {
    "Image
| endswith": "/bun",
    "CommandLine
| contains
| all": [
      "bun",
      "run",
      "tanstack_runner.js"
    ]
  },
  "selection_pypi_payload": {
    "Image
| contains": "/python3",
    "CommandLine
| contains": "/tmp/transformers.pyz"
  },
  "condition": "1 of selection_*"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...