Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Packages

Atomic Arch: AUR Package Supply Chain Compromise Using (TL-2026-0979), also tracked as Atomic Arch, is a critical-severity supply-chain compromise, first published 2026-06-12. It has no confirmed attribution, affects Arch Linux AUR (Arch User Repository), maps to 38 MITRE ATT&CK techniques (T1005, T1027.001, T1027.002), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-0979

Threat ID
TL-2026-0979
Also known as
Atomic Arch
Severity
CRITICAL
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-06-12
Last reviewed
2026-06-12
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
software development, cloud infrastructure, devops ci-cd, container kubernetes, open source development, financial services, health, government defense
Target regions
Global (Arch Linux users worldwide), North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
20

Malware and tooling in Atomic Arch: AUR Package Supply Chain Compromise Using

Malware and tooling: atomic-lockfile, js-digest

Critical supply chain attack compromised 400+ abandoned Arch User Repository (AUR) packages via malicious npm packages (atomic-lockfile v1.4.2, js-digest v4.2.2). Attackers modified PKGBUILD scripts to execute npm package installation, delivering credential-stealing malware and eBPF-based rootkits with systemd persistence to Arch Linux developers and CI/CD infrastructure. Packages injected via npm preinstall lifecycle hooks targeting developer credentials, SSH keys, cloud tokens, and browser session data.

How Atomic Arch: AUR Package Supply Chain Compromise Using works

Atomic Arch represents a sophisticated multi-stage supply chain attack targeting the Arch User Repository (AUR) and npm ecosystems. Attackers adopted control of 400+ orphaned/abandoned AUR packages through legitimate maintainer-transfer mechanisms, then modified PKGBUILD installation scripts to execute malicious npm package installations (atomic-lockfile v1.4.2, js-digest v4.2.2). The malicious npm packages contain bundled Linux ELF binaries executed via npm preinstall hooks without user interaction.

Upon installation, the malware executes a multi-stage payload: (1) Initial credential harvesting targeting Slack, Teams, Discord session tokens; browser password vaults; developer SSH keys; npm authentication tokens; GitHub personal access tokens; Docker/Podman credentials; and HashiCorp Vault tokens. (2) Privilege escalation and kernel-level persistence via eBPF-based rootkit deployment (when executed as root) establishing process, file system, and socket hiding capabilities. (3) Systemd service unit installation for persistence across system reboots. (4) Exfiltration of harvested credentials over Tor via onion service to attacker-controlled infrastructure, with fallback data staging to temporary file-sharing services (temp.sh).

The attack chain exploits fundamental trust in package manager supply chains: maintainer accounts, AUR adoption mechanisms, and npm preinstall script execution. Attackers demonstrated deep knowledge of Linux ecosystem mechanics, PKGBUILD scripting, npm lifecycle hooks, eBPF kernel programming, and systemd service architecture. The campaign operated for approximately 72 hours (June 10-12, 2026) before security researchers discovered and disclosed the incident. Critical finding: uninstallation of affected packages does NOT remediate payload effects — systems must be considered fully compromised at kernel level, requiring forensic remediation or complete OS reinstallation.

MITRE ATT&CK techniques used in TL-2026-0979

Collection

T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data; T1185 Browser Session Hijacking

Defense Evasion

T1027.001 Binary Padding; T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories; T1564.010 Process Argument Spoofing

Exfiltration

T1030 Data Transfer Size Limits; T1041 Exfiltration Over C2 Channel; T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Persistence

T1037.004 RC Scripts; T1547.014 Active Setup

Credential Access

T1056.001 Keylogging; T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API; T1555.003 Credentials from Web Browsers

Execution

T1059.004 Unix Shell; T1204.001 Malicious Link; T1569.001 Launchctl

Command and Control

T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1571 Non-Standard Port; T1572 Protocol Tunneling

Discovery

T1083 File and Directory Discovery; T1087.001 Local Account; T1526 Cloud Service Discovery

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools; T1195.003 Compromise Hardware Supply Chain; T1566.001 Spearphishing Attachment

Impact

T1485 Data Destruction

Privilege Escalation

T1548.003 Sudo and Sudo Caching; T1548.004 Elevated Execution with Prompt

stealth

T1574.011 Services Registry Permissions Weakness

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1584.006 Web Services

Affected products and versions in Atomic Arch: AUR Package Supply Chain Compromise Using

  • Arch Linux — AUR (Arch User Repository)
    Vulnerable versions: 400+ abandoned/orphaned packages as of June 2026
    Fixed in: Affected packages reverted to original state; npm packages removed from registry
  • npm — npm Package Registry
    Vulnerable versions: atomic-lockfile v1.4.2; js-digest v4.2.2
    Fixed in: Packages removed from registry as of June 12, 2026
  • Linux Kernel — eBPF Runtime
    Vulnerable versions: Linux 5.8+ (eBPF support)
  • systemd — Service Manager
    Vulnerable versions: All versions (systemd service unit persistence mechanism exploited)

Remediation for Atomic Arch: AUR Package Supply Chain Compromise Using

Patches

  • Update AUR packages from official repository or verify PKGBUILD integrity from original maintainers
  • No vendor patches required (attack is supply-chain compromise, not vulnerability in packages themselves)

Immediate actions

  • Remove atomic-lockfile and js-digest npm packages from all systems
  • Uninstall compromised AUR packages (verify PKGBUILD checksums against original sources)
  • Audit system logs for Tor connection attempts, systemd unit creation, and eBPF syscall execution (bpf syscalls)
  • Search for and remove suspicious systemd service units in /etc/systemd/system/
  • Scan file system for signs of eBPF rootkit installation (kernel module traces, eBPF maps)
  • Review all network connections during affected window (June 10-12, 2026) for Tor egress

Workarounds

  • Avoid AUR for security-sensitive workloads; use only official Arch Linux repositories
  • Implement network segmentation to isolate development and CI/CD systems
  • Use container image scanning and immutable deployments to prevent eBPF rootkit persistence
  • Enforce strict npm package pinning and vendoring to avoid dependency surprises
  • Require npm package integrity verification via npm lockfiles and hash verification

Longer-term hardening

  • Assume kernel-level compromise: rebuild systems from clean media or perform forensic remediation
  • Credential rotation: all SSH keys, npm tokens, GitHub PATs, AWS credentials, Docker creds, Vault tokens accessed during window must be rotated
  • Deploy EDR solutions with eBPF rootkit detection capabilities (monitor bpf() syscalls, suspicious kernel module loading)
  • Implement package source integrity verification (SBOM generation, cryptographic package signing)
  • Deploy supply chain security scanning (Socket.dev, Snyk, Phylum) to detect malicious package patterns
  • Enforce signed commits and verified package provenance in CI/CD pipelines

Weaknesses (CWE) in Atomic Arch: AUR Package Supply Chain Compromise Using

CWE-494, CWE-426, CWE-427, CWE-1357, CWE-1384

Timeline of Atomic Arch: AUR Package Supply Chain Compromise Using

  • First systems install compromised AUR packages; npm preinstall hooks execute malicious ELF binaries, initiating credential harvesting and privilege escalation routines.
  • Malicious npm packages published to npm registry: atomic-lockfile v1.4.2 and js-digest v4.2.2 containing bundled ELF binary payloads.
  • Attackers adopt control of 400+ abandoned AUR packages through legitimate maintainer-transfer mechanism. Malicious PKGBUILD scripts deployed to execute npm package installations.
  • Credential harvesting completes on initial batch of compromised systems. SSH keys, npm tokens, GitHub PATs, Docker credentials, AWS tokens, and Vault credentials exfiltrated to Tor onion service. Browser passwords and session data harvested from Chrome, Firefox, Electron applications.
  • eBPF-based rootkit deployed on systems running with sufficient privileges (root), establishing process, file system, and socket hiding capabilities. Systemd service units created for persistence across reboots.
  • Security community begins forensic analysis. Finding: uninstallation of affected packages does NOT remediate kernel-level compromise. Systems require complete forensic remediation or OS reinstallation.
  • Arch Linux security team notifies AUR community of package compromise. Affected packages reverted to original maintainers' versions. Warning issued recommending careful examination of PKGBUILD modifications.
  • npm registry removes atomic-lockfile v1.4.2 and js-digest v4.2.2 from public repository. Package repository access revoked; developers notified of compromise.
  • Security researchers discover and publicly disclose the supply chain attack. Wiz publishes comprehensive threat report with technical indicators and attack analysis.
  • Major security vendors (Unit 42/Palo Alto Networks, Sonatype, Cybereason) publish supplementary analysis. Atomic Arch identified as part of broader June 2026 npm supply chain attack wave (Miasma, Mini Shai-Hulud, Hades variants also active).

Sources cited for Atomic Arch: AUR Package Supply Chain Compromise Using

Threats related to Atomic Arch: AUR Package Supply Chain Compromise Using

Detection coverage for TL-2026-0979

As of 2026-06-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0979 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats