Arch Linux AUR Supply Chain Attack: 400+ Packages Hijacked with Rootkit and Infostealer

Attackers hijacked more than 400 packages in the Arch Linux community repository this week. Furthermore, the malicious build scripts installed a Rust credential stealer and an optional eBPF rootkit on developer workstations. This Arch Linux AUR supply chain attack exploits trust in abandoned packages, and it demands immediate action from anyone running Arch or Arch-based distributions.

What Happened: Arch Linux AUR Supply Chain Attack Hijacks 400+ Packages

The attack surfaced on June 11, 2026, when community members discovered unusual activity in the Arch User Repository (AUR). Consequently, security researchers traced the campaign to a threat actor who adopted orphaned packages and rewrote their build instructions.

The compromised packages kept their names, version histories, and the community trust that came with them. However, only the PKGBUILD and install scripts changed. The attackers spoofed git commit metadata so the malicious edits appeared to come from a long-standing maintainer. Therefore, the trap sat inside the build recipe, and the package itself looked exactly like the software users intended to install.

Security firm Sonatype named the campaign Atomic Arch and assigned it identifier Sonatype-2026-003775 with a CVSS score of 8.7. Moreover, a second wave emerged within 24 hours using a separate npm package called js-digest delivered through bun install.

Technical Details of the Arch Linux AUR Attack

The attack does not rely on a software vulnerability. Instead, it targets the AUR trust model directly. The AUR is a community-maintained repository of package build scripts, and it is separate from the officially vetted Arch repositories.

Once a threat actor adopted an orphaned package, the PKGBUILD or .install script was modified to run npm install atomic-lockfile during the build. Consequently, this pulled the malicious npm package alongside legitimate dependencies for cover. The package atomic-lockfile@1.4.2 carries a preinstall hook that executes a bundled Linux ELF binary named deps.

Malware Capabilities

Independent researcher Whanos reverse-engineered the payload and published findings through ioctl.fail. The Rust binary functions as a comprehensive credential stealer aimed at developer workstations and build environments:

• Cookies, tokens, and local storage from Chromium-based browsers (Chrome, Edge, Brave, and others)
• Session data from Electron apps including Slack, Discord, and Microsoft Teams
• GitHub, npm, and HashiCorp Vault tokens
• OpenAI and ChatGPT bearer tokens and account metadata
• SSH keys, known_hosts files, and shell histories
• Docker and Podman credentials and VPN profiles

Furthermore, stolen data is archived and exfiltrated over HTTP to temp.sh. Command and control communication routes through a Tor onion service via a local loopback proxy.

eBPF Rootkit Component

When the binary already has root privileges, it can optionally load an eBPF rootkit. This rootkit does not grant privileges; instead, it hides the malware’s own processes, process names, and socket inodes from standard system tools. Moreover, it uses pinned BPF maps named hidden_pids, hidden_names, and hidden_inodes, and it kills attempts to attach a debugger.

Persistence Mechanism

The malware installs a systemd service with Restart=always for persistence. With root access, it copies itself under /var/lib/ and writes a unit under /etc/systemd/system/. As a normal user, it uses the home directory and a per-user unit under ~/.config/systemd/user/. Therefore, it attempts to survive reboots regardless of privilege level.

The binary also stages a second file tied to monero-wallet-gui that analysts flag as a possible, unanalyzed cryptominer. Consequently, the combination of a credential stealer with an eBPF rootkit and a potential cryptominer makes this campaign unusually dangerous.

Business and Operational Impact

The Arch Linux AUR supply chain attack carries serious consequences for developers, DevOps teams, and organizations that rely on Arch-based build pipelines:

• Developer credential exposure: The malware targets the exact secrets that grant access to source code, cloud infrastructure, and internal services.
• CI/CD pipeline compromise: Build servers that install AUR packages may have leaked production tokens and container registry credentials.
• Rootkit persistence: The optional eBPF rootkit means compromised systems cannot be trusted even after removing the malicious package.
• Organizational lateral movement: Stolen SSH keys, VPN profiles, and cloud tokens enable attackers to pivot across networks.
• Supply-chain ripple effects: Compromised npm and GitHub tokens could poison downstream packages and repositories.

Sonatype initially reported more than 20 hijacked packages, but within a day community trackers and the Arch mailing list cataloged over 400. The atomic-lockfile npm package itself showed only 134 weekly downloads on Socket before removal, so the real exposure comes through the AUR build path rather than direct npm installs.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Check any AUR package installed or updated on or after June 11, 2026, against the community affected-package lists and detection scripts.
2. Grep recent build history and caches for npm install atomic-lockfile, bun install js-digest, and the payload path src/hooks/deps.
3. If a flagged package ran, treat the host as credential-compromised. Rotate every secret the stealer touches: browser sessions, SSH keys, GitHub and npm tokens, Slack, Teams and Discord sessions, Vault tokens, Docker and Podman credentials, and any cloud keys.
4. Hunt for persistence by checking for unknown systemd services (both system units and ~/.config/systemd/user/) and unexpected files under /var/lib/.
5. Inspect /sys/fs/bpf/ for pinned maps named hidden_pids, hidden_names, and hidden_inodes.
6. Review outbound connections to Tor and file upload services.
7. If the package ran as root, assume the rootkit is present and reinstall the system from trusted media. There is no way to trust the system otherwise.

Long-Term Defensive Measures

• Always review PKGBUILD and any .install hooks before building, especially for packages recently adopted or suddenly active after long dormancy.
• If you do not understand the build instructions, do not install the package.
• Prefer packages with frequent updates and an active community around them.
• Run AUR builds in isolated environments rather than on production workstations or CI/CD hosts.

Bottom line: This attack exploited trust in orphaned AUR packages to distribute a sophisticated credential stealer and rootkit. If you built any AUR package since June 11, verify it immediately, rotate all developer credentials, and reinstall from trusted media if the payload ran with root privileges.

Incident Summary

Incident ID:	Sonatype-2026-003775 (CVSS 8.7)
Affected Systems:	Arch Linux AUR packages (400+ hijacked); Arch-based distributions using AUR
Disclosure Date:	June 11-12, 2026
Patch Status:	AUR maintainers removing malicious commits and banning accounts; no CVE assigned
Malicious Packages:	atomic-lockfile (npm), js-digest (npm, second wave)
Payload Hash (SHA-256):	6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b

References

1. Bill Toulas, “Over 400 Arch Linux packages compromised to push rootkit, infostealer,” BleepingComputer, June 12, 2026, https://www.bleepingcomputer.com/news/security/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer/, accessed June 12, 2026.
2. “Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit,” The Hacker News, June 12, 2026, https://thehackernews.com/2026/06/over-400-arch-linux-aur-packages.html, accessed June 12, 2026.
3. Sonatype, “Atomic Arch: npm Campaign Adds Malicious Dependency to AUR Packages,” Sonatype Blog, June 12, 2026, https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency, accessed June 12, 2026.
4. Whanos, “Preliminary Analysis of AUR Malware: atomic-lockfile,” ioctl.fail, June 12, 2026, https://ioctl.fail/preliminary-analysis-of-aur-malware/, accessed June 12, 2026.
5. Jonathan Grotelüschen, “AUR Malicious Package Report,” Arch Linux AUR-General Mailing List, June 12, 2026, https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/, accessed June 12, 2026.
6. Michael Taggart, IFIN Network, “400 AUR Packages Compromised with Infostealer and Rootkit,” Independent Federated Intelligence Network, June 12, 2026, https://discourse.ifin.network/t/400-aur-packages-compromised-with-infostealer-and-rootkit/577, accessed June 12, 2026.