Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR Packages Deploys Rust Infostealer and eBPF Rootkit

Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR (TL-2026-1498), also tracked as Atomic Arch, is a high-severity supply-chain compromise scored CVSS 8.7, first published 2026-07-18. It has no confirmed attribution, affects Arch Linux Arch User Repository (AUR) packages, maps to 35 MITRE ATT&CK techniques (T1005, T1014, T1027), and is covered by 9 detection rules and 26 indicators of compromise.

Key facts for TL-2026-1498

Threat ID
TL-2026-1498
Also known as
Atomic Arch
Severity
HIGH
CVSS
8.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Status
TRACKING
Category
SUPPLY_CHAIN
First published
2026-07-18
Last reviewed
2026-07-18
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, software-development, devops, open-source-community
Target regions
Global
Detection rules
9
Indicators of compromise
26

Malware and tooling in Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR

Malware and tooling: Tor onion-service C2

Beginning June 11, 2026, threat actors adopted abandoned Arch User Repository (AUR) packages and modified their PKGBUILD/.install hooks to pull in trojanized npm/Bun packages (atomic-lockfile, js-digest, lockfile-js), which dropped a Rust-based ELF infostealer (deps) that harvests browser, SSH, cloud, CI/CD, and messaging credentials, and — on root installs — loads an eBPF rootkit for kernel-level process, file, and socket hiding. The campaign, dubbed "Atomic Arch" and tracked as Sonatype-2026-003775/003808, compromised 1,619 unique AUR package names across two waves before the npm packages were pulled and AUR maintainers reverted the packages.

How Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR works

The Atomic Arch campaign is a two-stage software supply chain attack that abused the Arch User Repository's (AUR) lax package-adoption governance to distribute credential-stealing malware and a stealth rootkit to Arch Linux and Arch-derivative users. Rather than tampering with the source code of the AUR packages themselves — which would be visible in package diffs and trigger community scrutiny — the attackers exploited AUR's 'orphan adoption' process, in which any registered user can request stewardship of a package abandoned by its original maintainer with no cryptographic continuity or identity verification. At least seven attacker-controlled AUR accounts (krisztinavarga, franziskaweber, tobiaswesterburg, ellenmyklebust, arojas — impersonating a legitimate maintainer handle, custodiatovar, veramagalhaes) adopted hundreds of orphaned packages and modified their PKGBUILD build scripts and .install hooks to invoke `npm install atomic-lockfile minimist chalk` (first wave, ~408 packages, discovered June 11, 2026) or a Bun-based `js-digest`/`lockfile-js` fetch (second wave, expanding the campaign to 1,619 verified unique package names by June 12, 2026).

Because AUR packages are built locally by the end user via `makepkg` (often wrapped by helpers such as `yay` or `paru`), the malicious npm/Bun lifecycle script executes with the full privileges of the invoking user at build time — this is the same trust model abused, just with an added layer of indirection through the npm/Bun ecosystem so that the AUR package tree itself stays 'clean' under manual review. The npm package `atomic-lockfile` (v1.4.2) shipped a `preinstall` lifecycle hook (`"preinstall": "./src/hooks/deps"`) that executed a bundled ELF64 PIE binary named `deps` (3,040,376 bytes, SHA-256 `6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b`), compiled in Rust.

The `deps` binary is a full-featured infostealer targeting the credential material that underpins developer workstation and CI/CD pipeline trust: browser cookie databases and session tokens (SSO, cloud consoles, SaaS), SSH private keys and known_hosts, GitHub and npm developer tokens, HashiCorp Vault tokens, Docker/Podman credentials, cloud provider access keys, Slack/Discord/Microsoft Teams/Telegram session data, OpenAI/ChatGPT bearer tokens, shell histories, and cryptocurrency wallet data. Exfiltration is split across two channels to separate control-plane and bulk-data traffic: a Tor onion-service C2 endpoint (`POST /api/agent`, reached via a local loopback SOCKS/Tor proxy) handles tasking and result reporting, while bulk file content is uploaded via `POST /upload` to the public ephemeral file-sharing service temp.sh — a technique that blends stolen-data exfiltration into traffic that looks like legitimate file-sharing activity and avoids attacker-registered infrastructure.

On systems where the malicious build executes with root privileges (common for AUR installs of system-level packages), `deps` additionally loads an eBPF-based rootkit (source referenced internally as `scales.bpf.c`) using standard libbpf loader APIs (`bpf_object__load`, `bpf_program__attach`, `bpf_map__pin`). The rootkit attaches to the `getdents64()` syscall — the kernel entry point underlying directory-listing operations — and filters directory-entry results before they reach user space, using three pinned BPF maps at `/sys/fs/bpf/`: `hidden_pids` (suppresses process IDs from tools like `ps`), `hidden_names` (removes filenames from listings for tools like `ls`/`find`), and `hidden_inodes` (hides by inode number to defeat alternate access paths). The rootkit also interferes with `PTRACE_ATTACH`/`PTRACE_SEIZE` to block debugger attachment to hidden processes and hooks `NETLINK_SOCK_DIAG` to conceal socket inodes from `/proc/net/*` and related diagnostics. Persistence is established via systemd service units (`Restart=always`) installed at `/etc/systemd/system/` for root compromises or `~/.config/systemd/user/` for unprivileged ones.

Confirmed/reported compromised AUR packages include `alvr` (VR streaming), `premake-git` (build tooling), and variants referencing `monero-wallet-gui` (with community reporting of a possible secondary cryptominer payload on some builds); the authoritative deduplicated list of 1,619 package names is maintained by the community `aur-malware-check` tracker. The malicious npm packages `atomic-lockfile` (1.4.2) and `js-digest` (4.2.2, published 2026-06-12T10:21:34Z and unpublished at 11:53:23Z) and `lockfile-js` (1.4.2, published 13:01:03Z, unpublished 16:29:49Z) were removed from the npm registry within hours of discovery, and AUR maintainers reverted the affected PKGBUILDs, closing the active infection window to roughly June 10–12, 2026. Security researchers stress that uninstalling the AUR package or npm dependency does not remediate an already-executed payload — any host that built or updated an affected package during the window must be treated as fully compromised, with all credentials, SSH keys, API tokens, and session cookies rotated.

MITRE ATT&CK techniques used in TL-2026-1498

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1564 Hide Artifacts; T1564.001 Hidden Files and Directories

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Discovery

T1057 Process Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1610 Deploy Container

Command and Control

T1071 Application Layer Protocol; T1071.001 Web Protocols; T1090 Proxy; T1090.003 Multi-hop Proxy

Initial Access

T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1552.001 Credentials In Files; T1552.004 Private Keys; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers

Persistence

T1543.002 Systemd Service; T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Resource Development

T1585 Establish Accounts; T1586 Compromise Accounts

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR

  • Arch Linux — Arch User Repository (AUR) packages
    Vulnerable versions: 1,619 unique AUR package names adopted/modified 2026-06-11 to 2026-06-12, including alvr, premake-git, monero-wallet-gui variants
    Fixed in: Reverted by AUR maintainers post-disclosure; affected packages restored to pre-compromise PKGBUILD state
  • npm, Inc. (npm registry) — atomic-lockfile
    Vulnerable versions: 1.4.2
    Fixed in: Removed from registry
  • npm, Inc. (npm registry) — js-digest
    Vulnerable versions: 4.2.2
    Fixed in: Removed from registry
  • npm, Inc. (npm registry) — lockfile-js
    Vulnerable versions: 1.4.2
    Fixed in: Removed from registry

Remediation for Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR

Patches

  • No vendor patch applicable — remediation is package reversion (already performed by AUR maintainers) plus npm registry takedown of atomic-lockfile, js-digest, and lockfile-js (already completed)

Immediate actions

  • Audit /var/log/pacman.log and shell/AUR-helper history for AUR package installs or updates between 2026-06-10 and 2026-06-12
  • Cross-reference installed/updated AUR packages against the aur-malware-check tracker's 1,619-package list (data/campaigns/aur-infected/packages.txt)
  • Check ~/.npm and ~/.bun caches for references to atomic-lockfile, js-digest, or lockfile-js
  • Scan for the src/hooks/deps ELF binary (SHA-256 6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b) on disk and in process history
  • Inspect /sys/fs/bpf/ for pinned maps named hidden_pids, hidden_names, or hidden_inodes indicating the eBPF rootkit is active
  • Review systemd units under /etc/systemd/system/ and ~/.config/systemd/user/ for unexplained Restart=always services created during the window
  • Treat any host that built an affected package with root privileges during the window as fully compromised, not just credential-exposed

Workarounds

  • Avoid adopting or rebuilding AUR packages that were recently transferred to a new maintainer without independent verification of the new maintainer's identity/history
  • Use the community aur-malware-check detection tool to scan hosts for known IOCs, hashes, persistence artifacts, and eBPF rootkit maps

Longer-term hardening

  • Rotate all SSH keys, GitHub/npm tokens, HashiCorp Vault tokens, cloud provider credentials, Docker/Podman credentials, and messaging-platform (Slack/Discord/Teams/Telegram) sessions on any affected host
  • Re-image hosts where root-level eBPF rootkit execution is suspected or confirmed, since kernel-level hiding undermines confidence in live forensic tooling
  • Adopt AUR-helper wrappers or CI policies that pin AUR packages to known-good commit hashes and diff PKGBUILD changes before rebuild, rather than trusting adoption metadata alone
  • Restrict or sandbox local package builds (makepkg/yay/paru) so build-time npm/Bun postinstall/preinstall scripts cannot reach developer credential stores or run as root by default
  • Monitor outbound Tor/onion-routed traffic and uploads to temp.sh and similar ephemeral file-sharing services from developer and CI/CD hosts as anomalous exfiltration indicators

Weaknesses (CWE) in Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR

CWE-494, CWE-506, CWE-522, CWE-829

Timeline of Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR

  • Attacker-controlled AUR accounts begin adopting orphaned/abandoned AUR packages and modifying PKGBUILD/.install hooks; earliest activity within the confirmed infection window.
  • First wave discovered: ~408 AUR packages modified to run `npm install atomic-lockfile minimist chalk` during build, dropping the atomic-lockfile npm package (v1.4.2) with a malicious preinstall hook.
  • AUR maintainers begin reverting affected PKGBUILDs to pre-compromise state, closing the active infection window.
  • Community tracking confirms the campaign has expanded to 1,619 verified unique AUR package names across both waves; Sonatype assigns advisory Sonatype-2026-003775 (CVSS 8.7) for atomic-lockfile and Sonatype-2026-003808 for js-digest/lockfile-js.
  • Malicious npm package js-digest v4.2.2 published, part of a second delivery vector using the Bun runtime.
  • js-digest v4.2.2 unpublished from the npm registry after discovery.
  • Malicious npm package lockfile-js v1.4.2 published, expanding the second wave.
  • lockfile-js v1.4.2 unpublished from the npm registry.
  • Mainstream security press (The Hacker News, BleepingComputer, SecurityWeek, StepSecurity) publishes coverage naming the campaign "Atomic Arch."
  • Cloud Security Alliance Labs and Wiz publish deep technical analyses of the eBPF rootkit's getdents64 hook and BPF map-based hiding mechanism.
  • Community detection tool aur-malware-check published on GitHub, consolidating IOCs, compromised package lists, and attacker AUR account names.
  • Truesec publishes consolidated blog analysis; Arch Linux community publishes the full list of compromised AUR packages via md.archlinux.org.

Sources cited for Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR

Threats related to Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR

Detection coverage for TL-2026-1498

As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1498 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats