Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Packages

Key facts for Atomic Arch AUR npm campaign

Detection coverage for Atomic Arch AUR npm campaign

As of 2026-06-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0979 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: npm Preinstall Hook Credential Harvesting Detection

Detects malicious npm preinstall hook execution spawning shell interpreters and accessing developer credential files. Identifies the initial exploitation phase where atomic-lockfile or js-digest npm packages trigger credential harvesting from SSH keys, npm tokens, AWS credentials, Docker configs, and browser vaults.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.003, T1552.001, T1555.003, T1059.001
• Data sources: sysmon_process_creation, windows_event_log, auditd_file_access, linux_syscalls
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon EventCode=1 ParentImage IN ("*npm.exe", "*node.exe", "*npm.cmd") Image IN ("*powershell.exe", "*cmd.exe", "*bash", "*sh") | search CommandLine IN ("*/.ssh/*", "*/.npmrc*", "*/.aws/*", "*/.docker/*", "*credential*", "*token*") OR (index=auditd syscall=openat exe IN ("/usr/bin/npm", "/usr/bin/node") name IN ("*id_rsa", ".npmrc", ".aws*", ".docker*") success=yes) | stats count, dc(name) as cred_files_accessed, values(name) as file_paths by host, user, ParentImage, Image | where cred_files_accessed > 2

Microsoft KQL

DeviceProcessEvents | where ParentFileName has_any ("npm.exe", "node.exe") and FileName has_any ("powershell.exe", "cmd.exe", "bash", "sh") and (CommandLine contains_any (".ssh", ".npmrc", ".aws", ".docker") or CommandLine matches regex "credential|token") | join kind=leftouter (DeviceFileEvents | where FileName has_any ("id_rsa", ".npmrc", "credentials", "config.json") and FolderPath has_any ("/home/", "/root/", "C:\\Users")) on DeviceId, ProcessId | summarize TotalFileAccess=dcount(FileName), AccessedFiles=make_set(FileName) by DeviceName, AccountName, ParentFileName, FileName | where TotalFileAccess > 2

Sigma

title: npm Preinstall Hook Credential Harvesting
id: 7a4c1e2a-b3f2-4e8d-9a1c-5f6e7a8b9c0d
status: experimental
description: Detects npm preinstall hook executing shells and accessing credential files. Identifies atomic-lockfile/js-digest malware credential harvesting phase.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-28
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith: ['npm.exe', 'node.exe', 'npm.cmd']
  selection_child:
    Image|endswith: ['powershell.exe', 'cmd.exe', 'bash', 'sh']
  selection_cmdline:
    CommandLine|contains: ['.ssh/id_rsa', '.npmrc', '.aws/credentials', '.docker/config.json', '.vault-token', 'credential', 'token']
  condition: selection_parent and selection_child and selection_cmdline
level: high

Known false positives:

• Legitimate npm build scripts with setup operations
• Development environments using npm for credential storage
• Automated CI/CD pipelines installing npm dependencies
• Package managers running credential verification tools

Tuning notes: Baseline legitimate npm processes in your environment and whitelist package paths. Tune threshold based on expected credential file access frequency. Exclude known CI/CD automation accounts if they legitimately access credential stores.

• 🔒 npm Preinstall Hook Credential File Access Pattern · unlock with TL Creds
• 🔒 eBPF Kernel Module Loading and Program Attachment · unlock with TL Creds
• 🔒 Systemd Service Installation with Suspicious Network Communication · unlock with TL Creds
• 🔒 npm Preinstall Hook Executing Shell Scripts and Accessing Credentials · unlock with TL Creds
• 🔒 eBPF Rootkit Program Loading via bpf Syscall · unlock with TL Creds
• 🔒 Systemd Service Unit Creation During Package Installation with Tor Communication · unlock with TL Creds
• 🔒 eBPF Rootkit Program Loading and Privilege Escalation · unlock with TL Creds
• 🔒 Systemd Service Persistence with Tor C2 Communication · unlock with TL Creds

Indicators of compromise for Atomic Arch AUR npm campaign

As of 2026-06-12, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-0979.

Sample indicators (1 of 20)

• Domain: temp[.]sh

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

How Atomic Arch AUR npm campaign works

Packages injected via npm preinstall lifecycle hooks targeting developer credentials, SSH keys, cloud tokens, and browser session data.

Atomic Arch represents a sophisticated multi-stage supply chain attack targeting the Arch User Repository (AUR) and npm ecosystems. Attackers adopted control of 400+ orphaned/abandoned AUR packages through legitimate maintainer-transfer mechanisms, then modified PKGBUILD installation scripts to execute malicious npm package installations (atomic-lockfile v1.4.2, js-digest v4.2.2). The malicious npm packages contain bundled Linux ELF binaries executed via npm preinstall hooks without user interaction.

Upon installation, the malware executes a multi-stage payload: (1) Initial credential harvesting targeting Slack, Teams, Discord session tokens; browser password vaults; developer SSH keys; npm authentication tokens; GitHub personal access tokens; Docker/Podman credentials; and HashiCorp Vault tokens. (2) Privilege escalation and kernel-level persistence via eBPF-based rootkit deployment (when executed as root) establishing process, file system, and socket hiding capabilities. (3) Systemd service unit installation for persistence across system reboots. (4) Exfiltration of harvested credentials over Tor via onion service to attacker-controlled infrastructure, with fallback data staging to temporary file-sharing services (temp.sh).

The attack chain exploits fundamental trust in package manager supply chains: maintainer accounts, AUR adoption mechanisms, and npm preinstall script execution. Attackers demonstrated deep knowledge of Linux ecosystem mechanics, PKGBUILD scripting, npm lifecycle hooks, eBPF kernel programming, and systemd service architecture. The campaign operated for approximately 72 hours (June 10-12, 2026) before security researchers discovered and disclosed the incident. Critical finding: uninstallation of affected packages does NOT remediate payload effects — systems must be considered fully compromised at kernel level, requiring forensic remediation or complete OS reinstallation.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data; T1185 Browser Session Hijacking

Defense Evasion

T1027.001 Binary Padding; T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories; T1564.010 Process Argument Spoofing

Exfiltration

T1030 Data Transfer Size Limits; T1041 Exfiltration Over C2 Channel; T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Persistence

T1037.004 RC Scripts; T1547.014 Active Setup

Credential Access

T1056.001 Keylogging; T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API; T1555.003 Credentials from Web Browsers

Execution

T1059.004 Unix Shell; T1204.001 Malicious Link; T1569.001 Launchctl

Command and Control

T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1571 Non-Standard Port; T1572 Protocol Tunneling

Discovery

T1083 File and Directory Discovery; T1087.001 Local Account; T1526 Cloud Service Discovery

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools; T1195.003 Compromise Hardware Supply Chain; T1566.001 Spearphishing Attachment

Impact

T1485 Data Destruction

Privilege Escalation

T1548.003 Sudo and Sudo Caching; T1548.004 Elevated Execution with Prompt

stealth

T1574.011 Services Registry Permissions Weakness

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1584.006 Web Services

Remediation for Atomic Arch AUR npm campaign

Patches

• Update AUR packages from official repository or verify PKGBUILD integrity from original maintainers
• No vendor patches required (attack is supply-chain compromise, not vulnerability in packages themselves)

Immediate actions

• Remove atomic-lockfile and js-digest npm packages from all systems
• Uninstall compromised AUR packages (verify PKGBUILD checksums against original sources)
• Audit system logs for Tor connection attempts, systemd unit creation, and eBPF syscall execution (bpf syscalls)
• Search for and remove suspicious systemd service units in /etc/systemd/system/
• Scan file system for signs of eBPF rootkit installation (kernel module traces, eBPF maps)
• Review all network connections during affected window (June 10-12, 2026) for Tor egress

Workarounds

• Avoid AUR for security-sensitive workloads; use only official Arch Linux repositories
• Implement network segmentation to isolate development and CI/CD systems
• Use container image scanning and immutable deployments to prevent eBPF rootkit persistence
• Enforce strict npm package pinning and vendoring to avoid dependency surprises
• Require npm package integrity verification via npm lockfiles and hash verification

Longer-term hardening

• Assume kernel-level compromise: rebuild systems from clean media or perform forensic remediation
• Credential rotation: all SSH keys, npm tokens, GitHub PATs, AWS credentials, Docker creds, Vault tokens accessed during window must be rotated
• Deploy EDR solutions with eBPF rootkit detection capabilities (monitor bpf() syscalls, suspicious kernel module loading)
• Implement package source integrity verification (SBOM generation, cryptographic package signing)
• Deploy supply chain security scanning (Socket.dev, Snyk, Phylum) to detect malicious package patterns
• Enforce signed commits and verified package provenance in CI/CD pipelines

Affected and fixed versions

• Arch Linux — AUR (Arch User Repository)
  Vulnerable versions: 400+ abandoned/orphaned packages as of June 2026
  Fixed in: Affected packages reverted to original state; npm packages removed from registry
• npm — npm Package Registry
  Vulnerable versions: atomic-lockfile v1.4.2; js-digest v4.2.2
  Fixed in: Packages removed from registry as of June 12, 2026
• Linux Kernel — eBPF Runtime
  Vulnerable versions: Linux 5.8+ (eBPF support)
• systemd — Service Manager
  Vulnerable versions: All versions (systemd service unit persistence mechanism exploited)

Timeline of Atomic Arch AUR npm campaign

• 2026-06-10 First systems install compromised AUR packages; npm preinstall hooks execute malicious ELF binaries, initiating credential harvesting and privilege escalation routines.
• 2026-06-10 Malicious npm packages published to npm registry: locked-ioc-14 v1.4.2 and locked-ioc-18 v4.2.2 containing bundled ELF binary payloads.
• 2026-06-10 Attackers adopt control of 400+ abandoned AUR packages through legitimate maintainer-transfer mechanism. Malicious PKGBUILD scripts deployed to execute npm package installations.
• 2026-06-11 Credential harvesting completes on initial batch of compromised systems. SSH keys, npm tokens, GitHub PATs, Docker credentials, AWS tokens, and Vault credentials exfiltrated to Tor onion service. Browser passwords and session data harvested from Chrome, Firefox, Electron applications.
• 2026-06-11 eBPF-based rootkit deployed on systems running with sufficient privileges (root), establishing process, file system, and socket hiding capabilities. Systemd service units created for persistence across reboots.
• 2026-06-12 Security community begins forensic analysis. Finding: uninstallation of affected packages does NOT remediate kernel-level compromise. Systems require complete forensic remediation or OS reinstallation.
• 2026-06-12 Arch Linux security team notifies AUR community of package compromise. Affected packages reverted to original maintainers' versions. Warning issued recommending careful examination of PKGBUILD modifications.
• 2026-06-12 npm registry removes locked-ioc-14 v1.4.2 and locked-ioc-18 v4.2.2 from public repository. Package repository access revoked; developers notified of compromise.
• 2026-06-12 Security researchers discover and publicly disclose the supply chain attack. Wiz publishes comprehensive threat report with technical indicators and attack analysis.
• 2026-06-15 Major security vendors (Unit 42/Palo Alto Networks, Sonatype, Cybereason) publish supplementary analysis. Atomic Arch identified as part of broader June 2026 npm supply chain attack wave (Miasma, Mini Shai-Hulud, Hades variants also active).

Sources cited for Atomic Arch AUR npm campaign

• Arch Linux Security Advisory - AUR Package Compromise Alert lists.archlinux.org · Advisory · 2026-06-12
• Sonatype: npm Supply Chain Security Analysis sonatype.com · Vendor report · 2026-06-12
• MITRE ATT&CK Framework - Supply Chain Compromise (T1195) MITRE · Research · 2024-01-01
• Unit 42 / Palo Alto Networks - Supply Chain Attack Trends 2026 Unit 42 · Vendor report · 2026-06-15
• eBPF for Rootkit Development and Defense lwn.net · Blog · 2019-05-01
• Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Package Wiz · Threat-report · 2026-06-12
• npm Lifecycle Scripts Security: Preinstall Hook Exploitation docs.npmjs.com · Documentation · 2026-01-01
• systemd Service Units and Persistence Mechanisms freedesktop.org · Documentation · 2024-01-01
• BeaconBeagle - C2 Infrastructure Tracking and IOC Correlation beaconbeagle.com · Tool · 2026-01-01
• Socket.dev - npm Package Supply Chain Security Scanning socket.dev · Tool · 2026-01-01

Threats related to Atomic Arch AUR npm campaign

• Nx Console VS Code Extension Backdoored (v18.95.0) — TeamPCP Mini Shai-Hulud Pivot from TanStack npm Worm to GitHub Internal Repository Breach (CVE-2026-48027)
• Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR Packages Deploys Rust Infostealer and eBPF Rootkit
• Leaked Shai-Hulud Source Code Fuels New npm Infostealer + DDoS Botnet Campaign (deadcode09284814, May 2026)

Previous and next in supply chain

• "Atomic Arch" AUR Supply-Chain Attack: 400+ Orphaned Arch User Repository Packages Backdoored via Malicious npm Dependencies (atomic-lockfile / js-digest) Deploying a Linux Infostealer with eBPF Rootkit Previous report
• Atomic Arch: 400+ Arch Linux AUR Packages Hijacked to Deliver Rust 'deps' Credential Stealer with eBPF Rootkit (Sonatype-2026-003775) Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages