# Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Packages

> Critical supply chain attack compromised 400+ abandoned Arch User Repository (AUR) packages via malicious npm packages (atomic-lockfile v1.4.2, js-digest v4.2.2). Attackers modified PKGBUILD scripts to execute npm package installation, delivering credential-stealing malware and eBPF-based rootkits with systemd persistence to Arch Linux developers and CI/CD infrastructure. Packages injected via npm preinstall lifecycle hooks targeting developer credentials, SSH keys, cloud tokens, and browser session data.

- **Published:** 2026-06-12T00:00:00Z
- **Last reviewed:** 2026-06-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0979
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-atomic-arch-aur-npm-campaign-tl-2026-0979.webp?v=4a4c0bed (Threadlinqs threat intel: Atomic Arch Hijacks 400+ AUR Packages: Detection & IOCs (TL-2026-0979) — Critical severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-0979
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (1 shown free below)

## Description

Atomic Arch represents a sophisticated multi-stage supply chain attack targeting the Arch User Repository (AUR) and npm ecosystems. Attackers adopted control of 400+ orphaned/abandoned AUR packages through legitimate maintainer-transfer mechanisms, then modified PKGBUILD installation scripts to execute malicious npm package installations (atomic-lockfile v1.4.2, js-digest v4.2.2). The malicious npm packages contain bundled Linux ELF binaries executed via npm preinstall hooks without user interaction.

Upon installation, the malware executes a multi-stage payload: (1) Initial credential harvesting targeting Slack, Teams, Discord session tokens; browser password vaults; developer SSH keys; npm authentication tokens; GitHub personal access tokens; Docker/Podman credentials; and HashiCorp Vault tokens. (2) Privilege escalation and kernel-level persistence via eBPF-based rootkit deployment (when executed as root) establishing process, file system, and socket hiding capabilities. (3) Systemd service unit installation for persistence across system reboots. (4) Exfiltration of harvested credentials over Tor via onion service to attacker-controlled infrastructure, with fallback data staging to temporary file-sharing services (temp.sh).

The attack chain exploits fundamental trust in package manager supply chains: maintainer accounts, AUR adoption mechanisms, and npm preinstall script execution. Attackers demonstrated deep knowledge of Linux ecosystem mechanics, PKGBUILD scripting, npm lifecycle hooks, eBPF kernel programming, and systemd service architecture. The campaign operated for approximately 72 hours (June 10-12, 2026) before security researchers discovered and disclosed the incident. Critical finding: uninstallation of affected packages does NOT remediate payload effects — systems must be considered fully compromised at kernel level, requiring forensic remediation or complete OS reinstallation.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1584.006 Web Services
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.003 Compromise Hardware Supply Chain
- T1566.001 Spearphishing Attachment
- T1059.004 Unix Shell
- T1204.001 Malicious Link
- T1569.001 Launchctl
- T1037.004 RC Scripts
- T1547.014 Active Setup
- T1574.011 Services Registry Permissions Weakness
- T1548.003 Sudo and Sudo Caching
- T1548.004 Elevated Execution with Prompt
- T1027.001 Binary Padding
- T1027.002 Software Packing
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1564.010 Process Argument Spoofing
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1056.001 Keylogging
- T1087.001 Local Account
- T1526 Cloud Service Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1185 Browser Session Hijacking
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1090.003 Multi-hop Proxy
- T1572 Protocol Tunneling
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
- T1030 Data Transfer Size Limits
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**npm Preinstall Hook Credential Harvesting Detection** (`TL-2026-0979-SPL-001`)

Detects malicious npm preinstall hook execution spawning shell interpreters and accessing developer credential files. Identifies the initial exploitation phase where atomic-lockfile or js-digest npm packages trigger credential harvesting from SSH keys, npm tokens, AWS credentials, Docker configs, and browser vaults.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.003, T1552.001, T1555.003, T1059.001
- **Data sources:** sysmon_process_creation, windows_event_log, auditd_file_access, linux_syscalls
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon EventCode=1 ParentImage IN ("*npm.exe", "*node.exe", "*npm.cmd") Image IN ("*powershell.exe", "*cmd.exe", "*bash", "*sh") | search CommandLine IN ("*/.ssh/*", "*/.npmrc*", "*/.aws/*", "*/.docker/*", "*credential*", "*token*") OR (index=auditd syscall=openat exe IN ("/usr/bin/npm", "/usr/bin/node") name IN ("*id_rsa", ".npmrc", ".aws*", ".docker*") success=yes) | stats count, dc(name) as cred_files_accessed, values(name) as file_paths by host, user, ParentImage, Image | where cred_files_accessed > 2
```

### Microsoft KQL

```kql
DeviceProcessEvents | where ParentFileName has_any ("npm.exe", "node.exe") and FileName has_any ("powershell.exe", "cmd.exe", "bash", "sh") and (CommandLine contains_any (".ssh", ".npmrc", ".aws", ".docker") or CommandLine matches regex "credential|token") | join kind=leftouter (DeviceFileEvents | where FileName has_any ("id_rsa", ".npmrc", "credentials", "config.json") and FolderPath has_any ("/home/", "/root/", "C:\\Users")) on DeviceId, ProcessId | summarize TotalFileAccess=dcount(FileName), AccessedFiles=make_set(FileName) by DeviceName, AccountName, ParentFileName, FileName | where TotalFileAccess > 2
```

### Sigma

```yaml
title: npm Preinstall Hook Credential Harvesting
id: 7a4c1e2a-b3f2-4e8d-9a1c-5f6e7a8b9c0d
status: experimental
description: Detects npm preinstall hook executing shells and accessing credential files. Identifies atomic-lockfile/js-digest malware credential harvesting phase.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-28
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith: ['npm.exe', 'node.exe', 'npm.cmd']
  selection_child:
    Image|endswith: ['powershell.exe', 'cmd.exe', 'bash', 'sh']
  selection_cmdline:
    CommandLine|contains: ['.ssh/id_rsa', '.npmrc', '.aws/credentials', '.docker/config.json', '.vault-token', 'credential', 'token']
  condition: selection_parent and selection_child and selection_cmdline
level: high
```

**Known false positives:**

- Legitimate npm build scripts with setup operations
- Development environments using npm for credential storage
- Automated CI/CD pipelines installing npm dependencies
- Package managers running credential verification tools

**Tuning notes:** Baseline legitimate npm processes in your environment and whitelist package paths. Tune threshold based on expected credential file access frequency. Exclude known CI/CD automation accounts if they legitimately access credential stores.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- npm Preinstall Hook Credential File Access Pattern (locked: unlock with TL Creds)
- eBPF Kernel Module Loading and Program Attachment (locked: unlock with TL Creds)
- Systemd Service Installation with Suspicious Network Communication (locked: unlock with TL Creds)
- npm Preinstall Hook Executing Shell Scripts and Accessing Credentials (locked: unlock with TL Creds)
- eBPF Rootkit Program Loading via bpf Syscall (locked: unlock with TL Creds)
- Systemd Service Unit Creation During Package Installation with Tor Communication (locked: unlock with TL Creds)
- eBPF Rootkit Program Loading and Privilege Escalation (locked: unlock with TL Creds)
- Systemd Service Persistence with Tor C2 Communication (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 20)

Defanged, TLP:CLEAR.

- Domain: `temp[.]sh`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Package](https://threats.wiz.io/all-incidents/atomic-arch-aur-package-supply-chain-compromise-using-malicious-npm-package)
- [Arch Linux Security Advisory - AUR Package Compromise Alert](https://lists.archlinux.org/pipermail/arch-security/)
- [Sonatype: npm Supply Chain Security Analysis](https://www.sonatype.com/npm-supply-chain)
- [MITRE ATT&CK Framework - Supply Chain Compromise (T1195)](https://attack.mitre.org/techniques/T1195/)
- [Unit 42 / Palo Alto Networks - Supply Chain Attack Trends 2026](https://unit42.paloaltonetworks.com/supply-chain-threats/)
- [eBPF for Rootkit Development and Defense](https://lwn.net/Articles/740157/)
- [npm Lifecycle Scripts Security: Preinstall Hook Exploitation](https://docs.npmjs.com/cli/v9/using-npm/scripts)
- [systemd Service Units and Persistence Mechanisms](https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html)
- [BeaconBeagle - C2 Infrastructure Tracking and IOC Correlation](https://beaconbeagle.com/)
- [Socket.dev - npm Package Supply Chain Security Scanning](https://socket.dev/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0979