Full Breakdown
Massive Supply-Chain Attack Compromises Over 400 Arch Linux AUR Packages
6/13/2026, 1:01:33 PM
Mass Compromise of Arch Linux AUR Packages
In early June 2026 attackers hijacked over 400 Arch User Repository (AUR) packages, modifying PKGBUILD or .install scripts to pull a malicious npm package (atomic-lockfile) that installs a Rust credential stealer. When run as root the payload can load an optional eBPF rootkit that hides its processes.
Context and Actors
The AUR trusts a package’s name and history more than current maintainer identity, allowing attackers to adopt abandoned projects and spoof commit metadata. Sonatype researchers labeled the campaign “Atomic Arch” (ID Sonatype-2026-003775, CVSS 8.7). Community trackers on the Arch mailing list and CachyOS forums compiled the affected-package lists. Arch Linux maintainers and Trusted Users oversee the repository.
Timeline and Scale
- June 11 – First compromised packages observed.
- June 12-13 – Community identifies ~20 hijacked packages; Sonatype publishes analysis.
- June 14 – Arch maintainers reset malicious commits, ban offending accounts, and issue remediation guidance.
- June 15 onward – A second wave using npm package js-digest appears; total compromised packages rise to ~408 and continue to grow.
Impact, Official Response, and Criticism
The stealer exfiltrates browser cookies, tokens, SSH keys, Docker/Podman credentials, GitHub, npm, Vault, OpenAI/ChatGPT tokens, and VPN profiles via HTTP to a temporary host. The optional eBPF rootkit can conceal processes and block debugging, complicating cleanup. Arch maintainers advise rotating all harvested credentials, checking for unknown systemd services, and reinstalling from trusted media if root was compromised. Critics note the AUR’s reliance on package provenance rather than active maintainer verification and the lack of an assigned CVE.
Conflicting Reports and Gaps
Sources list 408 compromised packages, but ongoing greps suggest a higher count. The full extent of the js-digest wave remains unquantified, and no CVE has been issued.
Verbatim Quotes
- “Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them.” — The Hacker News
- “The compromised packages kept their names, their histories, and the trust that came with them.” — The Hacker News
- “For persistence, it installs a systemd service with Restart=always.” — The Hacker News
- “What to do now Arch maintainers are resetting the malicious commits, banning the accounts, and asking users to keep reporting suspect packages in the mailing-list thread.” — The Hacker News
What’s Next
Community detection scripts will keep comparing installed foreign packages against the growing bad-package list. Monitoring for the js-digest wave continues, and Arch developers are reviewing policy changes to require stronger verification for resurrected projects.
