Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR Packages Deploys Rust Infostealer and eBPF Rootkit — Threadlinqs Intelligence
As of 2026-07-18, Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR Packages Deploys Rust Infostealer and eBPF Rootkit is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-1498 · Severity: HIGH · CVSS: 8.7 · Status: TRACKING · Category: SUPPLY_CHAIN
Beginning June 11, 2026, threat actors adopted abandoned Arch User Repository (AUR) packages and modified their PKGBUILD/.install hooks to pull in trojanized npm/Bun packages (atomic-lockfile,
The Atomic Arch campaign is a two-stage software supply chain attack that abused the Arch User Repository's (AUR) lax package-adoption governance to distribute credential-stealing malware and a stealth rootkit to Arch Linux and Arch-derivative users. Rather than tampering with the source code of the AUR packages themselves — which would be visible in package diffs and trigger community scrutiny — the attackers exploited AUR's 'orphan adoption' process, in which any registered user can request stewardship of a package abandoned by its original maintainer with no cryptographic continuity or identity verification. At least seven attacker-controlled AUR accounts (krisztinavarga, franziskaweber, tobiaswesterburg, ellenmyklebust, arojas — impersonating a legitimate maintainer handle, custodiatovar, veramagalhaes) adopted hundreds of orphaned packages and modified their PKGBUILD build scripts and .install hooks to invoke `npm install atomic-lockfile minimist chalk` (first wave, ~408 packages, discovered June 11, 2026) or a Bun-based `js-digest`/`lockfile-js` fetch (second wave, expanding the campaign to 1,619 verified unique package names by June 12, 2026).
Because AUR packages are built locally by the end user via `makepkg` (often wrapped by helpers such as `yay` or `paru`), the malicious npm/Bun lifecycle script executes with the full privileges of the invoking user at build time — this is the same trust model abused, just with an added layer of indirection through the npm/Bun ecosystem so that the AUR package tree itself stays 'clean' under manual review. The npm package `atomic-lockfile` (v1.4.2) shipped a `preinstall` lifecycle hook (`"preinstall": "./src/hooks/deps"`) that executed a bundled ELF64 PIE binary named `deps` (3,040,376 bytes, SHA-256 `6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b`), compiled in Rust.
The `deps` binary is a full-featured infostealer targeting the credential material that underpins developer workstation and CI/CD pipeline trust: browser cookie databases and session tokens (SSO, cloud consoles, SaaS), SSH private keys and known_hosts, GitHub and npm developer tokens, HashiCorp Vault tokens, Docker/Podman credentials, cloud provider access keys, Slack/Discord/Microsoft Teams/Telegram session data, OpenAI/ChatGPT bearer tokens, shell histories, and cryptocurrency wallet data. Exfiltration is split across two channels to separate control-plane and bulk-data traffic: a Tor onion-service C2 endpoint (`POST /api/agent`, reached via a local loopback SOCKS/Tor proxy) handles tasking and result reporting, while bulk file content is uploaded via `POST /upload` to the public ephemeral file-sharing service temp.sh — a technique that blends stolen-data exfiltration into traffic that looks like legitimate file-sharing activity and avoids attacker-registered infrastructure.
On systems where the malicious build executes with root privileges (common for AUR installs of system-level packages), `deps` additionally loads an eBPF-based rootkit (source referenced internally as `scales.bpf.c`) using standard libbpf loader APIs (`bpf_object__load`, `bpf_program__attach`, `bpf_map__pin`). The rootkit attaches to the `getdents64()` syscall — the kernel entry point underlying directory-listing operations — and filters directory-entry results before they reach user space, using three pinned BPF maps at `/sys/fs/bpf/`: `hidden_pids` (suppresses process IDs from tools like `ps`), `hidden_names` (removes filenames from listings for tools like `ls`/`find`), and `hidden_inodes` (hides by inode number to defeat alternate access paths). The rootkit also interferes with `PTRACE_ATTACH`/`PTRACE_SEIZE` to block debugger attachment to hidden processes and hooks `NETLINK_SOCK_DIAG` to conceal socket inodes from `/proc/net/*` and related diagnostics. Persistence is established via systemd service units (`Restart=always`) installed at `/etc/systemd/system/` for root compromises or `~/.config/systemd/user/` for unprivileg
Weaknesses (CWE)
CWE-494, CWE-506, CWE-522, CWE-829
Target sectors: technology, software-development, devops, open-source-community
Target regions: Global
Detections & IOCs
As of 2026-07-23, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1586, T1585, T1195, T1195.001, T1195.002, T1059, T1204, T1610, T1547, T1543.002