TanStack Supply-Chain Attack DNS Indicators

experimentalmedium
Log-Quelle: windows · dns_queryAutor Leonardo GaspariniDatum 2026-05-12
01

Beschreibung

Was dies ist, in Kürze.

Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on. The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz. The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.

02

Tags

attack.command-and-controlattack.t1071.001attack.exfiltrationattack.t1048detection.emerging-threats
03

Regelquelle (YAML)

title: TanStack Supply-Chain Attack DNS Indicators
id: ac5a4e3f-7f9d-6abc-d8ea-3b4c5f6a7b8c
status: experimental
description: |
    Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on.
    The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz.
    The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.
references:
    - https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
    - https://socket.dev/supply-chain-attacks/mini-shai-hulud
    - https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
author: Leonardo Gasparini
date: 2026-05-12
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.exfiltration
    - attack.t1048
    - detection.emerging-threats
logsource:
    category: dns_query
    product: windows
detection:
    selection_attacker_apex:
        QueryName: 'git-tanstack.com'
    selection_session_exfil:
        QueryName: 'filev2.getsession.org'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium
04

erkennt Techniken (2)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.