TanStack npm Supply Chain Compromise - File IOCs (Payload, Persistence, Dead-Man

Montaser Ismail@M0nt3x

•updated Aug 31, 2026•3•0•5

This rule detects file-based activity associated with a tool named 'gh-token-monitor', which is likely used for the monitoring or exfiltration of GitHub access tokens from a compromised host. The rule monitors for the creation or presence of specific scripts, configuration files, and directory paths associated with this activity, including files related to a 'claude' configuration.