Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR Packages Deploys Rust Infostealer and eBPF Rootkit

Key facts for Atomic Arch 1,619-package AUR hijack

Detection coverage for Atomic Arch 1,619-package AUR hijack

As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1498 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Rust Infostealer 'deps' Execution and Mass Credential-Store File Access

Detects execution of the known 'deps' ELF64 PIE infostealer (by hash or path pattern src/hooks/deps) or bulk file-read access to browser cookie stores, SSH keys, npm/GitHub tokens, HashiCorp Vault tokens, cloud CLI credentials, and messaging session data by a process descended from npm/Bun/makepkg — the post-exploitation credential-harvesting stage of Atomic Arch.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1555.003, T1552.001, T1552.004, T1528, T1539, T1005
• Data sources: sysmon, linux_audit, edr_file_events
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (1,11)
| eval Image=coalesce(Image, exe)
| eval TargetFilename=coalesce(TargetFilename, file_path)
| where match(Image, "(?i)/(hooks/)?deps$") OR Hashes="SHA256=6144D433F8A0316869877B5F834C801251BBB936E5F1577C5680878C7443C98B" OR match(TargetFilename, "(?i)(\.ssh/|\.npmrc|cookies\.sqlite|\.aws/credentials|\.docker/config\.json|vault-token|\.config/(slack|discord|teams|telegram))")
| stats count values(TargetFilename) as files_touched min(_time) as first_seen by host, Image, ParentImage, user
| where count >= 3

Microsoft KQL

let malwareHash = "6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b";
DeviceFileEvents
| where Timestamp > ago(24h)
| where SHA256 == malwareHash or FileName =~ "deps" or FolderPath has_any (".ssh", ".npmrc", "cookies.sqlite", ".aws\\credentials", ".docker\\config.json", "vault-token")
| where InitiatingProcessParentFileName has_any ("npm", "bun", "makepkg")
| summarize FilesTouched=make_set(FolderPath), Count=count() by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| where Count >= 3

Sigma

title: Rust Infostealer 'deps' Execution or Mass Credential-Store Access (Atomic Arch)
id: 9a2c4e6f-1b3d-4a5c-8e7f-2b4d6e8f0a1c
status: experimental
description: Detects execution of the known Atomic Arch 'deps' infostealer binary (by hash or path) or bulk credential-store file access by a process descended from npm/Bun/makepkg.
references:
    - https://www.truesec.com/hub/blog/supply-chain-attack-compromising-arch-linux-aur-packages-infostealer-rootkit
cve.na: true
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-18
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1552.004
    - attack.t1528
    - attack.t1005
logsource:
    category: file_event
    product: linux
detection:
    selection_hash:
        Hashes|contains: '6144D433F8A0316869877B5F834C801251BBB936E5F1577C5680878C7443C98B'
    selection_path:
        Image|endswith: '/deps'
    selection_targets:
        TargetFilename|contains:
            - '.ssh/'
            - '.npmrc'
            - 'cookies.sqlite'
            - '.aws/credentials'
            - '.docker/config.json'
            - 'vault-token'
    condition: selection_hash or selection_path or selection_targets
falsepositives:
    - Legitimate backup or credential-rotation tooling reading the same file classes in bulk
level: critical

Known false positives:

• Password managers, backup agents, or credential-rotation scripts legitimately reading the same file classes

Tuning notes: Whitelist known EDR/backup agents that legitimately enumerate these paths; prioritize alerts where the parent lineage includes npm/bun/makepkg within the same session.

• 🔒 Rogue AUR-Helper-Triggered npm/Bun Preinstall Chain to Unsigned Binary Execution · unlock with TL Creds
• 🔒 Suspicious systemd Persistence Unit Created Outside Package-Manager Transaction · unlock with TL Creds
• 🔒 Anti-Debugging PTRACE Denial and NETLINK_SOCK_DIAG Interference by Unknown Process · unlock with TL Creds
• 🔒 Known Malicious npm Package Install ([indicator] / [indicator] / [indicator]) · unlock with TL Creds
• 🔒 Bulk Messaging/Cloud/CI-CD Token Harvesting Consistent With '[indicator]' Infostealer Collection · unlock with TL Creds
• 🔒 Dual-Channel Exfil: Tor/SOCKS Proxy Tasking Beacon + temp.sh Bulk Upload · unlock with TL Creds
• 🔒 AUR/npm/Bun Lifecycle Script Spawning Suspicious Child Process (Atomic Arch) · unlock with TL Creds
• 🔒 eBPF Rootkit Pinned Map Creation Under /sys/fs/bpf (getdents64 Hiding) · unlock with TL Creds

Indicators of compromise for Atomic Arch 1,619-package AUR hijack

As of 2026-07-18, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-1498.

Sample indicators (2 of 26)

• URL: hxxps://temp[.]sh/upload
• File hash: 6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

How Atomic Arch 1,619-package AUR hijack works

The campaign, dubbed "Atomic Arch" and tracked as Sonatype-2026-003775/003808, compromised 1,619 unique AUR package names across two waves before the npm packages were pulled and AUR maintainers reverted the packages.

The Atomic Arch campaign is a two-stage software supply chain attack that abused the Arch User Repository's (AUR) lax package-adoption governance to distribute credential-stealing malware and a stealth rootkit to Arch Linux and Arch-derivative users. Rather than tampering with the source code of the AUR packages themselves — which would be visible in package diffs and trigger community scrutiny — the attackers exploited AUR's 'orphan adoption' process, in which any registered user can request stewardship of a package abandoned by its original maintainer with no cryptographic continuity or identity verification. At least seven attacker-controlled AUR accounts (krisztinavarga, franziskaweber, tobiaswesterburg, ellenmyklebust, arojas — impersonating a legitimate maintainer handle, custodiatovar, veramagalhaes) adopted hundreds of orphaned packages and modified their PKGBUILD build scripts and .install hooks to invoke `npm install atomic-lockfile minimist chalk` (first wave, ~408 packages, discovered June 11, 2026) or a Bun-based `js-digest`/`lockfile-js` fetch (second wave, expanding the campaign to 1,619 verified unique package names by June 12, 2026).

Because AUR packages are built locally by the end user via `makepkg` (often wrapped by helpers such as `yay` or `paru`), the malicious npm/Bun lifecycle script executes with the full privileges of the invoking user at build time — this is the same trust model abused, just with an added layer of indirection through the npm/Bun ecosystem so that the AUR package tree itself stays 'clean' under manual review. The npm package `atomic-lockfile` (v1.4.2) shipped a `preinstall` lifecycle hook (`"preinstall": "./src/hooks/deps"`) that executed a bundled ELF64 PIE binary named `deps` (3,040,376 bytes, SHA-256 `6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b`), compiled in Rust.

The `deps` binary is a full-featured infostealer targeting the credential material that underpins developer workstation and CI/CD pipeline trust: browser cookie databases and session tokens (SSO, cloud consoles, SaaS), SSH private keys and known_hosts, GitHub and npm developer tokens, HashiCorp Vault tokens, Docker/Podman credentials, cloud provider access keys, Slack/Discord/Microsoft Teams/Telegram session data, OpenAI/ChatGPT bearer tokens, shell histories, and cryptocurrency wallet data. Exfiltration is split across two channels to separate control-plane and bulk-data traffic: a Tor onion-service C2 endpoint (`POST /api/agent`, reached via a local loopback SOCKS/Tor proxy) handles tasking and result reporting, while bulk file content is uploaded via `POST /upload` to the public ephemeral file-sharing service temp.sh — a technique that blends stolen-data exfiltration into traffic that looks like legitimate file-sharing activity and avoids attacker-registered infrastructure.

On systems where the malicious build executes with root privileges (common for AUR installs of system-level packages), `deps` additionally loads an eBPF-based rootkit (source referenced internally as `scales.bpf.c`) using standard libbpf loader APIs (`bpf_object__load`, `bpf_program__attach`, `bpf_map__pin`). The rootkit attaches to the `getdents64()` syscall — the kernel entry point underlying directory-listing operations — and filters directory-entry results before they reach user space, using three pinned BPF maps at `/sys/fs/bpf/`: `hidden_pids` (suppresses process IDs from tools like `ps`), `hidden_names` (removes filenames from listings for tools like `ls`/`find`), and `hidden_inodes` (hides by inode number to defeat alternate access paths). The rootkit also interferes with `PTRACE_ATTACH`/`PTRACE_SEIZE` to block debugger attachment to hidden processes and hooks `NETLINK_SOCK_DIAG` to conceal socket inodes from `/proc/net/*` and related diagnostics. Persistence is established via systemd service units (`Restart=always`) installed at `/etc/systemd/system/` for root compromises or `~/.config/systemd/user/` for unprivileged ones.

Confirmed/reported compromised AUR packages include `alvr` (VR streaming), `premake-git` (build tooling), and variants referencing `monero-wallet-gui` (with community reporting of a possible secondary cryptominer payload on some builds); the authoritative deduplicated list of 1,619 package names is maintained by the community `aur-malware-check` tracker. The malicious npm packages `atomic-lockfile` (1.4.2) and `js-digest` (4.2.2, published 2026-06-12T10:21:34Z and unpublished at 11:53:23Z) and `lockfile-js` (1.4.2, published 13:01:03Z, unpublished 16:29:49Z) were removed from the npm registry within hours of discovery, and AUR maintainers reverted the affected PKGBUILDs, closing the active infection window to roughly June 10–12, 2026. Security researchers stress that uninstalling the AUR package or npm dependency does not remediate an already-executed payload — any host that built or updated an affected package during the window must be treated as fully compromised, with all credentials, SSH keys, API tokens, and session cookies rotated.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1564 Hide Artifacts; T1564.001 Hidden Files and Directories

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Discovery

T1057 Process Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1610 Deploy Container

Command and Control

T1071 Application Layer Protocol; T1071.001 Web Protocols; T1090 Proxy; T1090.003 Multi-hop Proxy

Initial Access

T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1552.001 Credentials In Files; T1552.004 Private Keys; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers

Persistence

T1543.002 Systemd Service; T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Resource Development

T1585 Establish Accounts; T1586 Compromise Accounts

defense-impairment

T1685 Disable or Modify Tools

Remediation for Atomic Arch 1,619-package AUR hijack

Patches

• No vendor patch applicable — remediation is package reversion (already performed by AUR maintainers) plus npm registry takedown of atomic-lockfile, js-digest, and lockfile-js (already completed)

Immediate actions

• Audit /var/log/pacman.log and shell/AUR-helper history for AUR package installs or updates between 2026-06-10 and 2026-06-12
• Cross-reference installed/updated AUR packages against the aur-malware-check tracker's 1,619-package list (data/campaigns/aur-infected/packages.txt)
• Check ~/.npm and ~/.bun caches for references to atomic-lockfile, js-digest, or lockfile-js
• Scan for the src/hooks/deps ELF binary (SHA-256 6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b) on disk and in process history
• Inspect /sys/fs/bpf/ for pinned maps named hidden_pids, hidden_names, or hidden_inodes indicating the eBPF rootkit is active
• Review systemd units under /etc/systemd/system/ and ~/.config/systemd/user/ for unexplained Restart=always services created during the window
• Treat any host that built an affected package with root privileges during the window as fully compromised, not just credential-exposed

Workarounds

• Avoid adopting or rebuilding AUR packages that were recently transferred to a new maintainer without independent verification of the new maintainer's identity/history
• Use the community aur-malware-check detection tool to scan hosts for known IOCs, hashes, persistence artifacts, and eBPF rootkit maps

Longer-term hardening

• Rotate all SSH keys, GitHub/npm tokens, HashiCorp Vault tokens, cloud provider credentials, Docker/Podman credentials, and messaging-platform (Slack/Discord/Teams/Telegram) sessions on any affected host
• Re-image hosts where root-level eBPF rootkit execution is suspected or confirmed, since kernel-level hiding undermines confidence in live forensic tooling
• Adopt AUR-helper wrappers or CI policies that pin AUR packages to known-good commit hashes and diff PKGBUILD changes before rebuild, rather than trusting adoption metadata alone
• Restrict or sandbox local package builds (makepkg/yay/paru) so build-time npm/Bun postinstall/preinstall scripts cannot reach developer credential stores or run as root by default
• Monitor outbound Tor/onion-routed traffic and uploads to temp.sh and similar ephemeral file-sharing services from developer and CI/CD hosts as anomalous exfiltration indicators

Affected and fixed versions

• Arch Linux — Arch User Repository (AUR) packages
  Vulnerable versions: 1,619 unique AUR package names adopted/modified 2026-06-11 to 2026-06-12, including alvr, premake-git, monero-wallet-gui variants
  Fixed in: Reverted by AUR maintainers post-disclosure; affected packages restored to pre-compromise PKGBUILD state
• npm, Inc. (npm registry) — atomic-lockfile
  Vulnerable versions: 1.4.2
  Fixed in: Removed from registry
• npm, Inc. (npm registry) — js-digest
  Vulnerable versions: 4.2.2
  Fixed in: Removed from registry
• npm, Inc. (npm registry) — lockfile-js
  Vulnerable versions: 1.4.2
  Fixed in: Removed from registry

Timeline of Atomic Arch 1,619-package AUR hijack

• 2026-06-10 Attacker-controlled AUR accounts begin adopting orphaned/abandoned AUR packages and modifying PKGBUILD/.install hooks; earliest activity within the confirmed infection window.
• 2026-06-11 First wave discovered: ~408 AUR packages modified to run `locked-ioc-2` during build, dropping the locked-ioc-14 npm package (v1.4.2) with a malicious preinstall hook.
• 2026-06-12 AUR maintainers begin reverting affected PKGBUILDs to pre-compromise state, closing the active infection window.
• 2026-06-12 Community tracking confirms the campaign has expanded to 1,619 verified unique AUR package names across both waves; Sonatype assigns advisory Sonatype-2026-003775 (CVSS 8.7) for locked-ioc-14 and Sonatype-2026-003808 for locked-ioc-23/locked-ioc-20.
• 2026-06-12 Malicious npm package locked-ioc-23 v4.2.2 published, part of a second delivery vector using the Bun runtime.
• 2026-06-12 locked-ioc-23 v4.2.2 unpublished from the npm registry after discovery.
• 2026-06-12 Malicious npm package locked-ioc-20 v1.4.2 published, expanding the second wave.
• 2026-06-12 locked-ioc-20 v1.4.2 unpublished from the npm registry.
• 2026-06-13 Mainstream security press (The Hacker News, BleepingComputer, SecurityWeek, StepSecurity) publishes coverage naming the campaign "Atomic Arch."
• 2026-06-14 Cloud Security Alliance Labs and Wiz publish deep technical analyses of the eBPF rootkit's getdents64 hook and BPF map-based hiding mechanism.
• 2026-06-14 Community detection tool aur-malware-check published on GitHub, consolidating IOCs, compromised package lists, and attacker AUR account names.
• 2026-06-16 Truesec publishes consolidated blog analysis; Arch Linux community publishes the full list of compromised AUR packages via md.archlinux.org.

Sources cited for Atomic Arch 1,619-package AUR hijack

• List of compromised AUR packages md.archlinux.org · Advisory · 2026-06-16
• Supply Chain Attack Compromising Arch Linux AUR Packages with Infostealer and Rootkit truesec.com · Vendor report · 2026-06-16
• Atomic Arch: AUR Supply Chain Attack Deploys eBPF Rootkit labs.cloudsecurityalliance.org · Research · 2026-06-14
• Atomic Arch Supply Chain Attack Compromises 1,500 Arch User Repository Packages rescana.com · Research · 2026-06-15
• Atomic Arch npm Campaign Adds Malicious Dependency sonatype.com · Vendor report · 2026-06-12
• Atomic Arch turned orphaned AUR packages into npm and Bun malware launchers corgea.com · Research · 2026-06-15
• Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Package Wiz · Vendor report · 2026-06-14
• aur-malware-check: Detection tools for the June 2026 atomic-lockfile AUR supply-chain attack GitHub · Code repository · 2026-06-14
• Arch Linux AUR Supply Chain Compromise: 400+ Packages Distributing Rootkit and Infostealer threat-modeling.com · Blog · 2026-06-13
• 400+ AUR Packages Hijacked: What the "Atomic Arch" Campaign Means for Supply-Chain Security stepsecurity.io · Blog · 2026-06-13
• Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit The Hacker News · News · 2026-06-13
• Atomic Arch: 900+ AUR Packages Backdoored with eBPF Rootkit thecybersecguru.com · News · 2026-06-13
• Around 1,500 AUR Packages Compromised with "Rootkit-Like" Malware privacyguides.org · News · 2026-06-12
• Over 400 Arch Linux packages compromised to push rootkit, infostealer BleepingComputer · News · 2026-06-12
• Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages SecurityWeek · News · 2026-06-13

Threats related to Atomic Arch 1,619-package AUR hijack

• Atomic Arch: 400+ Arch Linux AUR Packages Hijacked to Deliver Rust 'deps' Credential Stealer with eBPF Rootkit (Sonatype-2026-003775)
• "Atomic Arch" AUR Supply-Chain Attack: 400+ Orphaned Arch User Repository Packages Backdoored via Malicious npm Dependencies (atomic-lockfile / js-digest) Deploying a Linux Infostealer with eBPF Rootkit
• AsyncAPI npm Supply Chain Attack: Pwn-Request GitHub Actions Compromise Deploys Miasma Tasking Framework
• Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp" Trick and Bun Runtime to Steal Developer Credentials Across npm, Go, and RubyGems
• TeamPCP @antv Supply Chain Wave — Mini Shai-Hulud Multi-Ecosystem npm/GitHub Actions/VSCode Compromise

Related coverage of this activity

• Atomic Arch AUR npm campaign
• RedC2 npm AI-powered backdoor
• Miasma 57-package npm worm
• SleeperGem Forgejo systemd persistence
• Mini Shai-Hulud v3 worm

Previous and next in supply chain

• "Download Pumping" — npm Supply-Chain Trust-Signal Abuse via Mass Version Uploads (ambar-src / reverse_ssh / Apfell) Previous report
• SleeperGem: RubyGems Supply Chain Attack via Compromised Dormant Maintainer Accounts Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages