Tanstack Runner Execution

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•2

Detects the execution of 'tanstack_runner.js', which is identified as a specific payload dropped during a compromised tanstack npm supply chain incident linked to Miasma. The rule looks for command-line executions involving 'node' or 'bun run' with 'tanstack_runner.js'.