Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Packages
Atomic Arch: AUR Package Supply Chain Compromise Using (TL-2026-0979), also tracked as Atomic Arch, is a critical-severity supply-chain compromise, first published 2026-06-12. It has no confirmed attribution, affects Arch Linux AUR (Arch User Repository), maps to 38 MITRE ATT&CK techniques (T1005, T1027.001, T1027.002), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0979
- Threat ID
- TL-2026-0979
- Also known as
- Atomic Arch
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-12
- Last reviewed
- 2026-06-12
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- software development, cloud infrastructure, devops ci-cd, container kubernetes, open source development, financial services, health, government defense
- Target regions
- Global (Arch Linux users worldwide), North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Atomic Arch: AUR Package Supply Chain Compromise Using
Malware and tooling: atomic-lockfile, js-digest
Critical supply chain attack compromised 400+ abandoned Arch User Repository (AUR) packages via malicious npm packages (atomic-lockfile v1.4.2, js-digest v4.2.2). Attackers modified PKGBUILD scripts to execute npm package installation, delivering credential-stealing malware and eBPF-based rootkits with systemd persistence to Arch Linux developers and CI/CD infrastructure. Packages injected via npm preinstall lifecycle hooks targeting developer credentials, SSH keys, cloud tokens, and browser session data.
How Atomic Arch: AUR Package Supply Chain Compromise Using works
Atomic Arch represents a sophisticated multi-stage supply chain attack targeting the Arch User Repository (AUR) and npm ecosystems. Attackers adopted control of 400+ orphaned/abandoned AUR packages through legitimate maintainer-transfer mechanisms, then modified PKGBUILD installation scripts to execute malicious npm package installations (atomic-lockfile v1.4.2, js-digest v4.2.2). The malicious npm packages contain bundled Linux ELF binaries executed via npm preinstall hooks without user interaction.
Upon installation, the malware executes a multi-stage payload: (1) Initial credential harvesting targeting Slack, Teams, Discord session tokens; browser password vaults; developer SSH keys; npm authentication tokens; GitHub personal access tokens; Docker/Podman credentials; and HashiCorp Vault tokens. (2) Privilege escalation and kernel-level persistence via eBPF-based rootkit deployment (when executed as root) establishing process, file system, and socket hiding capabilities. (3) Systemd service unit installation for persistence across system reboots. (4) Exfiltration of harvested credentials over Tor via onion service to attacker-controlled infrastructure, with fallback data staging to temporary file-sharing services (temp.sh).
The attack chain exploits fundamental trust in package manager supply chains: maintainer accounts, AUR adoption mechanisms, and npm preinstall script execution. Attackers demonstrated deep knowledge of Linux ecosystem mechanics, PKGBUILD scripting, npm lifecycle hooks, eBPF kernel programming, and systemd service architecture. The campaign operated for approximately 72 hours (June 10-12, 2026) before security researchers discovered and disclosed the incident. Critical finding: uninstallation of affected packages does NOT remediate payload effects — systems must be considered fully compromised at kernel level, requiring forensic remediation or complete OS reinstallation.
MITRE ATT&CK techniques used in TL-2026-0979
Collection
T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data; T1185 Browser Session Hijacking
Defense Evasion
T1027.001 Binary Padding; T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories; T1564.010 Process Argument Spoofing
Exfiltration
T1030 Data Transfer Size Limits; T1041 Exfiltration Over C2 Channel; T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
Persistence
T1037.004 RC Scripts; T1547.014 Active Setup
Credential Access
T1056.001 Keylogging; T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API; T1555.003 Credentials from Web Browsers
Execution
T1059.004 Unix Shell; T1204.001 Malicious Link; T1569.001 Launchctl
Command and Control
T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1571 Non-Standard Port; T1572 Protocol Tunneling
Discovery
T1083 File and Directory Discovery; T1087.001 Local Account; T1526 Cloud Service Discovery
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools; T1195.003 Compromise Hardware Supply Chain; T1566.001 Spearphishing Attachment
Impact
Privilege Escalation
T1548.003 Sudo and Sudo Caching; T1548.004 Elevated Execution with Prompt
stealth
T1574.011 Services Registry Permissions Weakness
Resource Development
T1583.001 Domains; T1583.006 Web Services; T1584.006 Web Services
Affected products and versions in Atomic Arch: AUR Package Supply Chain Compromise Using
- Arch Linux — AUR (Arch User Repository)
Vulnerable versions: 400+ abandoned/orphaned packages as of June 2026
Fixed in: Affected packages reverted to original state; npm packages removed from registry - npm — npm Package Registry
Vulnerable versions: atomic-lockfile v1.4.2; js-digest v4.2.2
Fixed in: Packages removed from registry as of June 12, 2026 - Linux Kernel — eBPF Runtime
Vulnerable versions: Linux 5.8+ (eBPF support) - systemd — Service Manager
Vulnerable versions: All versions (systemd service unit persistence mechanism exploited)
Remediation for Atomic Arch: AUR Package Supply Chain Compromise Using
Patches
- Update AUR packages from official repository or verify PKGBUILD integrity from original maintainers
- No vendor patches required (attack is supply-chain compromise, not vulnerability in packages themselves)
Immediate actions
- Remove atomic-lockfile and js-digest npm packages from all systems
- Uninstall compromised AUR packages (verify PKGBUILD checksums against original sources)
- Audit system logs for Tor connection attempts, systemd unit creation, and eBPF syscall execution (bpf syscalls)
- Search for and remove suspicious systemd service units in /etc/systemd/system/
- Scan file system for signs of eBPF rootkit installation (kernel module traces, eBPF maps)
- Review all network connections during affected window (June 10-12, 2026) for Tor egress
Workarounds
- Avoid AUR for security-sensitive workloads; use only official Arch Linux repositories
- Implement network segmentation to isolate development and CI/CD systems
- Use container image scanning and immutable deployments to prevent eBPF rootkit persistence
- Enforce strict npm package pinning and vendoring to avoid dependency surprises
- Require npm package integrity verification via npm lockfiles and hash verification
Longer-term hardening
- Assume kernel-level compromise: rebuild systems from clean media or perform forensic remediation
- Credential rotation: all SSH keys, npm tokens, GitHub PATs, AWS credentials, Docker creds, Vault tokens accessed during window must be rotated
- Deploy EDR solutions with eBPF rootkit detection capabilities (monitor bpf() syscalls, suspicious kernel module loading)
- Implement package source integrity verification (SBOM generation, cryptographic package signing)
- Deploy supply chain security scanning (Socket.dev, Snyk, Phylum) to detect malicious package patterns
- Enforce signed commits and verified package provenance in CI/CD pipelines
Weaknesses (CWE) in Atomic Arch: AUR Package Supply Chain Compromise Using
CWE-494, CWE-426, CWE-427, CWE-1357, CWE-1384
Timeline of Atomic Arch: AUR Package Supply Chain Compromise Using
- First systems install compromised AUR packages; npm preinstall hooks execute malicious ELF binaries, initiating credential harvesting and privilege escalation routines.
- Malicious npm packages published to npm registry: atomic-lockfile v1.4.2 and js-digest v4.2.2 containing bundled ELF binary payloads.
- Attackers adopt control of 400+ abandoned AUR packages through legitimate maintainer-transfer mechanism. Malicious PKGBUILD scripts deployed to execute npm package installations.
- Credential harvesting completes on initial batch of compromised systems. SSH keys, npm tokens, GitHub PATs, Docker credentials, AWS tokens, and Vault credentials exfiltrated to Tor onion service. Browser passwords and session data harvested from Chrome, Firefox, Electron applications.
- eBPF-based rootkit deployed on systems running with sufficient privileges (root), establishing process, file system, and socket hiding capabilities. Systemd service units created for persistence across reboots.
- Security community begins forensic analysis. Finding: uninstallation of affected packages does NOT remediate kernel-level compromise. Systems require complete forensic remediation or OS reinstallation.
- Arch Linux security team notifies AUR community of package compromise. Affected packages reverted to original maintainers' versions. Warning issued recommending careful examination of PKGBUILD modifications.
- npm registry removes atomic-lockfile v1.4.2 and js-digest v4.2.2 from public repository. Package repository access revoked; developers notified of compromise.
- Security researchers discover and publicly disclose the supply chain attack. Wiz publishes comprehensive threat report with technical indicators and attack analysis.
- Major security vendors (Unit 42/Palo Alto Networks, Sonatype, Cybereason) publish supplementary analysis. Atomic Arch identified as part of broader June 2026 npm supply chain attack wave (Miasma, Mini Shai-Hulud, Hades variants also active).
Sources cited for Atomic Arch: AUR Package Supply Chain Compromise Using
- Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Package
- Arch Linux Security Advisory - AUR Package Compromise Alert
- Sonatype: npm Supply Chain Security Analysis
- MITRE ATT&CK Framework - Supply Chain Compromise (T1195)
- Unit 42 / Palo Alto Networks - Supply Chain Attack Trends 2026
- eBPF for Rootkit Development and Defense
- npm Lifecycle Scripts Security: Preinstall Hook Exploitation
- systemd Service Units and Persistence Mechanisms
- BeaconBeagle - C2 Infrastructure Tracking and IOC Correlation
- Socket.dev - npm Package Supply Chain Security Scanning
Threats related to Atomic Arch: AUR Package Supply Chain Compromise Using
- Nx Console VS Code Extension Backdoored (v18.95.0) — TeamPCP Mini Shai-Hulud Pivot from TanStack npm Worm to GitHub Internal Repository Breach (CVE-2026-48027)
- Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR Packages Deploys Rust Infostealer and eBPF Rootkit
- Leaked Shai-Hulud Source Code Fuels New npm Infostealer + DDoS Botnet Campaign (deadcode09284814, May 2026)
Detection coverage for TL-2026-0979
As of 2026-06-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0979 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.