TanStack 'Mini Shai-Hulud' Supply Chain Attack: IOC Analysis and macOS Hardening

---
title: Potential Malicious NPM Postinstall Script Execution
id: 8a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects npm or node processes spawning shell commands, indicative of malicious postinstall scripts often used in supply chain attacks like Mini Shai-Hulud.
references:
  - https://thehackernews.com/2026/05/tanstack-supply-chain-attack-hits-two.html
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1195.002
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
      - '/npm'
      - '/node'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build scripts using shell utilities (verify specific package activity)
level: high
---
title: Suspicious Outbound Connection from Node Process
id: 9b3c2d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects network connections initiated directly by node or npm shortly after process start, a common C2 beaconing behavior in compromised packages.
references:
  - https://thehackernews.com/2026/05/tanstack-supply-chain-attack-hits-two.html
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: macos
detection:
  selection:
    Image|endswith:
      - '/node'
      - '/npm'
    Initiated: 'true'
  filter:
    DestinationIp|cidr:
      - '127.0.0.0/8'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter
falsepositives:
  - Legitimate npm registry connections (registry.npmjs.org)
level: medium

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("npm", "node", "yarn", "pnpm")
| where FileName in ("sh", "bash", "zsh", "curl", "wget", "python", "python3")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, CommandLine, SHA256
| order by Timestamp desc

-- Hunt for npm or node spawning shells or network tools
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.CommandLine AS ParentCmd
FROM pslist()
WHERE Parent.Name in ("node", "npm", "yarn")
  AND Name in ("sh", "bash", "zsh", "curl", "wget")

#!/bin/bash

# Audit TanStack packages in project directories
echo "[+] Auditing local projects for TanStack packages..."
find ~ -type f -name "package." -exec grep -l "@tanstack" {} \; 2>/dev/null | while read file; do
    echo "Found TanStack dependency in: $file"
    dir=$(dirname "$file")
    # Check for specific compromised versions if available, otherwise flag all for review
    npm list --depth=0 2>/dev/null | grep "@tanstack"
done

# Force clean npm cache to remove potentially malicious tarballs
echo "[+] Cleaning npm cache to remove potentially malicious artifacts..."
npm cache clean --force

# Verify integrity of node_modules (requires package-lock.)
echo "[+] Verifying package integrity..."
# This command checks the local packages against the hashes in package-lock.
if [ -f "package-lock." ]; then
    npm ci 2>/dev/null || echo "Warning: Integrity check failed or package-lock missing. Manual audit required."
else
    echo "No package-lock. found in current directory. Skipping integrity check."
fi

echo "[+] Remediation steps completed. Please review 'npm audit' output."
npm audit