TanStack-Supply-Chain

TanStack Supply-Chain Attack DNS Indicators

Jul 9, 2026 · attack.command-and-control attack.t1071.001 attack.exfiltration attack.t1048 detection.emerging-threats ·

Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on. The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz. The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.

TanStack Supply-Chain Attack Execution Indicators - Linux

Jul 9, 2026 · attack.execution attack.t1059.007 attack.t1059.006 attack.t1204.002 detection.emerging-threats ·

Share on:

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.

TanStack Supply-Chain Attack Execution Indicators - Windows

Jul 9, 2026 · attack.execution attack.t1059.007 attack.t1204.002 detection.emerging-threats ·

Share on:

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath reported on early May 2026.

TanStack Supply-Chain Attack File Creation Indicators - Linux

Jul 9, 2026 · attack.initial-access attack.t1195.002 attack.execution attack.t1059.007 attack.persistence attack.privilege-escalation attack.t1547.004 detection.emerging-threats ·

Share on:

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.

TanStack Supply-Chain Attack File Creation Indicators - Windows

Jul 9, 2026 · attack.initial-access attack.t1195.002 attack.execution attack.t1059.007 attack.persistence attack.t1554 detection.emerging-threats ·

Share on:

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.