# Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR Packages Deploys Rust Infostealer and eBPF Rootkit

> Beginning June 11, 2026, threat actors adopted abandoned Arch User Repository (AUR) packages and modified their PKGBUILD/.install hooks to pull in trojanized npm/Bun packages (atomic-lockfile, js-digest, lockfile-js), which dropped a Rust-based ELF infostealer (deps) that harvests browser, SSH, cloud, CI/CD, and messaging credentials, and — on root installs — loads an eBPF rootkit for kernel-level process, file, and socket hiding. The campaign, dubbed "Atomic Arch" and tracked as Sonatype-2026-003775/003808, compromised 1,619 unique AUR package names across two waves before the npm packages were pulled and AUR maintainers reverted the packages.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1498
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-atomic-arch-1-619-package-aur-hijack-tl-2026-1498.webp?v=03b1f207 (Threadlinqs threat intel: Atomic Arch Hijacks 1,619 AUR Packages: Detection & IOCs (TL-2026-1498) — High severity, 26 IOCs, 9 detection rules.)
- **ID:** TL-2026-1498
- **Severity:** HIGH (CVSS 8.7)
- **Category:** SUPPLY_CHAIN
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (2 shown free below)

## Description

The Atomic Arch campaign is a two-stage software supply chain attack that abused the Arch User Repository's (AUR) lax package-adoption governance to distribute credential-stealing malware and a stealth rootkit to Arch Linux and Arch-derivative users. Rather than tampering with the source code of the AUR packages themselves — which would be visible in package diffs and trigger community scrutiny — the attackers exploited AUR's 'orphan adoption' process, in which any registered user can request stewardship of a package abandoned by its original maintainer with no cryptographic continuity or identity verification. At least seven attacker-controlled AUR accounts (krisztinavarga, franziskaweber, tobiaswesterburg, ellenmyklebust, arojas — impersonating a legitimate maintainer handle, custodiatovar, veramagalhaes) adopted hundreds of orphaned packages and modified their PKGBUILD build scripts and .install hooks to invoke `npm install atomic-lockfile minimist chalk` (first wave, ~408 packages, discovered June 11, 2026) or a Bun-based `js-digest`/`lockfile-js` fetch (second wave, expanding the campaign to 1,619 verified unique package names by June 12, 2026).

Because AUR packages are built locally by the end user via `makepkg` (often wrapped by helpers such as `yay` or `paru`), the malicious npm/Bun lifecycle script executes with the full privileges of the invoking user at build time — this is the same trust model abused, just with an added layer of indirection through the npm/Bun ecosystem so that the AUR package tree itself stays 'clean' under manual review. The npm package `atomic-lockfile` (v1.4.2) shipped a `preinstall` lifecycle hook (`"preinstall": "./src/hooks/deps"`) that executed a bundled ELF64 PIE binary named `deps` (3,040,376 bytes, SHA-256 `6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b`), compiled in Rust.

The `deps` binary is a full-featured infostealer targeting the credential material that underpins developer workstation and CI/CD pipeline trust: browser cookie databases and session tokens (SSO, cloud consoles, SaaS), SSH private keys and known_hosts, GitHub and npm developer tokens, HashiCorp Vault tokens, Docker/Podman credentials, cloud provider access keys, Slack/Discord/Microsoft Teams/Telegram session data, OpenAI/ChatGPT bearer tokens, shell histories, and cryptocurrency wallet data. Exfiltration is split across two channels to separate control-plane and bulk-data traffic: a Tor onion-service C2 endpoint (`POST /api/agent`, reached via a local loopback SOCKS/Tor proxy) handles tasking and result reporting, while bulk file content is uploaded via `POST /upload` to the public ephemeral file-sharing service temp.sh — a technique that blends stolen-data exfiltration into traffic that looks like legitimate file-sharing activity and avoids attacker-registered infrastructure.

On systems where the malicious build executes with root privileges (common for AUR installs of system-level packages), `deps` additionally loads an eBPF-based rootkit (source referenced internally as `scales.bpf.c`) using standard libbpf loader APIs (`bpf_object__load`, `bpf_program__attach`, `bpf_map__pin`). The rootkit attaches to the `getdents64()` syscall — the kernel entry point underlying directory-listing operations — and filters directory-entry results before they reach user space, using three pinned BPF maps at `/sys/fs/bpf/`: `hidden_pids` (suppresses process IDs from tools like `ps`), `hidden_names` (removes filenames from listings for tools like `ls`/`find`), and `hidden_inodes` (hides by inode number to defeat alternate access paths). The rootkit also interferes with `PTRACE_ATTACH`/`PTRACE_SEIZE` to block debugger attachment to hidden processes and hooks `NETLINK_SOCK_DIAG` to conceal socket inodes from `/proc/net/*` and related diagnostics. Persistence is established via systemd service units (`Restart=always`) installed at `/etc/systemd/system/` for root compromises or `~/.config/systemd/user/` for unprivileged ones.

Confirmed/reported compromised AUR packages include `alvr` (VR streaming), `premake-git` (build tooling), and variants referencing `monero-wallet-gui` (with community reporting of a possible secondary cryptominer payload on some builds); the authoritative deduplicated list of 1,619 package names is maintained by the community `aur-malware-check` tracker. The malicious npm packages `atomic-lockfile` (1.4.2) and `js-digest` (4.2.2, published 2026-06-12T10:21:34Z and unpublished at 11:53:23Z) and `lockfile-js` (1.4.2, published 13:01:03Z, unpublished 16:29:49Z) were removed from the npm registry within hours of discovery, and AUR maintainers reverted the affected PKGBUILDs, closing the active infection window to roughly June 10–12, 2026. Security researchers stress that uninstalling the AUR package or npm dependency does not remediate an already-executed payload — any host that built or updated an affected package during the window must be treated as fully compromised, with all credentials, SSH keys, API tokens, and session cookies rotated.

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1585 Establish Accounts
- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1610 Deploy Container
- T1547 Boot or Logon Autostart Execution
- T1543.002 Systemd Service
- T1548 Abuse Elevation Control Mechanism
- T1014 Rootkit
- T1564 Hide Artifacts
- T1564.001 Hidden Files and Directories
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1090 Proxy
- T1090.003 Multi-hop Proxy
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Rust Infostealer 'deps' Execution and Mass Credential-Store File Access** (`TL-2026-1498-SPL-002`)

Detects execution of the known 'deps' ELF64 PIE infostealer (by hash or path pattern src/hooks/deps) or bulk file-read access to browser cookie stores, SSH keys, npm/GitHub tokens, HashiCorp Vault tokens, cloud CLI credentials, and messaging session data by a process descended from npm/Bun/makepkg — the post-exploitation credential-harvesting stage of Atomic Arch.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1552.001, T1552.004, T1528, T1539, T1005
- **Data sources:** sysmon, linux_audit, edr_file_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (1,11)
| eval Image=coalesce(Image, exe)
| eval TargetFilename=coalesce(TargetFilename, file_path)
| where match(Image, "(?i)/(hooks/)?deps$") OR Hashes="SHA256=6144D433F8A0316869877B5F834C801251BBB936E5F1577C5680878C7443C98B" OR match(TargetFilename, "(?i)(\.ssh/|\.npmrc|cookies\.sqlite|\.aws/credentials|\.docker/config\.json|vault-token|\.config/(slack|discord|teams|telegram))")
| stats count values(TargetFilename) as files_touched min(_time) as first_seen by host, Image, ParentImage, user
| where count >= 3
```

### Microsoft KQL

```kql
let malwareHash = "6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b";
DeviceFileEvents
| where Timestamp > ago(24h)
| where SHA256 == malwareHash or FileName =~ "deps" or FolderPath has_any (".ssh", ".npmrc", "cookies.sqlite", ".aws\\credentials", ".docker\\config.json", "vault-token")
| where InitiatingProcessParentFileName has_any ("npm", "bun", "makepkg")
| summarize FilesTouched=make_set(FolderPath), Count=count() by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| where Count >= 3
```

### Sigma

```yaml
title: Rust Infostealer 'deps' Execution or Mass Credential-Store Access (Atomic Arch)
id: 9a2c4e6f-1b3d-4a5c-8e7f-2b4d6e8f0a1c
status: experimental
description: Detects execution of the known Atomic Arch 'deps' infostealer binary (by hash or path) or bulk credential-store file access by a process descended from npm/Bun/makepkg.
references:
    - https://www.truesec.com/hub/blog/supply-chain-attack-compromising-arch-linux-aur-packages-infostealer-rootkit
cve.na: true
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-18
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1552.004
    - attack.t1528
    - attack.t1005
logsource:
    category: file_event
    product: linux
detection:
    selection_hash:
        Hashes|contains: '6144D433F8A0316869877B5F834C801251BBB936E5F1577C5680878C7443C98B'
    selection_path:
        Image|endswith: '/deps'
    selection_targets:
        TargetFilename|contains:
            - '.ssh/'
            - '.npmrc'
            - 'cookies.sqlite'
            - '.aws/credentials'
            - '.docker/config.json'
            - 'vault-token'
    condition: selection_hash or selection_path or selection_targets
falsepositives:
    - Legitimate backup or credential-rotation tooling reading the same file classes in bulk
level: critical
```

**Known false positives:**

- Password managers, backup agents, or credential-rotation scripts legitimately reading the same file classes

**Tuning notes:** Whitelist known EDR/backup agents that legitimately enumerate these paths; prioritize alerts where the parent lineage includes npm/bun/makepkg within the same session.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Rogue AUR-Helper-Triggered npm/Bun Preinstall Chain to Unsigned Binary Execution (locked: unlock with TL Creds)
- Suspicious systemd Persistence Unit Created Outside Package-Manager Transaction (locked: unlock with TL Creds)
- Anti-Debugging PTRACE Denial and NETLINK_SOCK_DIAG Interference by Unknown Process (locked: unlock with TL Creds)
- Known Malicious npm Package Install ([indicator] / [indicator] / [indicator]) (locked: unlock with TL Creds)
- Bulk Messaging/Cloud/CI-CD Token Harvesting Consistent With '[indicator]' Infostealer Collection (locked: unlock with TL Creds)
- Dual-Channel Exfil: Tor/SOCKS Proxy Tasking Beacon + temp.sh Bulk Upload (locked: unlock with TL Creds)
- AUR/npm/Bun Lifecycle Script Spawning Suspicious Child Process (Atomic Arch) (locked: unlock with TL Creds)
- eBPF Rootkit Pinned Map Creation Under /sys/fs/bpf (getdents64 Hiding) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 26)

Defanged, TLP:CLEAR.

- URL: `hxxps://temp[.]sh/upload`
- File hash: `6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Supply Chain Attack Compromising Arch Linux AUR Packages with Infostealer and Rootkit](https://www.truesec.com/hub/blog/supply-chain-attack-compromising-arch-linux-aur-packages-infostealer-rootkit)
- [List of compromised AUR packages](https://md.archlinux.org/s/SxbqukK6IA)
- [Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit](https://thehackernews.com/2026/06/over-400-arch-linux-aur-packages.html)
- [Atomic Arch: AUR Supply Chain Attack Deploys eBPF Rootkit](https://labs.cloudsecurityalliance.org/research/csa-research-note-aur-supply-chain-ebpf-rootkit-20260614-csa/)
- [aur-malware-check: Detection tools for the June 2026 atomic-lockfile AUR supply-chain attack](https://github.com/lenucksi/aur-malware-check)
- [Arch Linux AUR Supply Chain Compromise: 400+ Packages Distributing Rootkit and Infostealer](https://threat-modeling.com/arch-linux-aur-supply-chain-compromise-june-2026/)
- [Atomic Arch: 900+ AUR Packages Backdoored with eBPF Rootkit](https://thecybersecguru.com/news/atomic-arch-aur-supply-chain-attack-ebpf-rootkit/)
- [Atomic Arch Supply Chain Attack Compromises 1,500 Arch User Repository Packages](https://www.rescana.com/post/atomic-arch-supply-chain-attack-compromises-1-500-arch-user-repository-packages-credential-stealing-malware-targets-arch)
- [400+ AUR Packages Hijacked: What the "Atomic Arch" Campaign Means for Supply-Chain Security](https://www.stepsecurity.io/blog/400-aur-packages-hijacked-atomic-arch-campaign)
- [Atomic Arch npm Campaign Adds Malicious Dependency](https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency)
- [Atomic Arch turned orphaned AUR packages into npm and Bun malware launchers](https://corgea.com/research/atomic-arch-aur-atomic-lockfile-js-digest-ebpf-rootkit)
- [Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Package](https://threats.wiz.io/all-incidents/atomic-arch-aur-package-supply-chain-compromise-using-malicious-npm-package)
- [Around 1,500 AUR Packages Compromised with "Rootkit-Like" Malware](https://www.privacyguides.org/news/2026/06/12/around-1-500-aur-packages-compromised-with-rootkit-like-malware/)
- [Over 400 Arch Linux packages compromised to push rootkit, infostealer](https://www.bleepingcomputer.com/news/security/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer/)
- [Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages](https://www.securityweek.com/atomic-arch-supply-chain-attack-hits-1500-aur-packages/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1498