Atomic Arch Campaign Hijacks 400+ AUR Packages to Deliver Rust Stealer and Optional eBPF Rootkit

Summary

Atomic Arch attackers hijacked more than 400 AUR packages with malicious build scripts delivering a Rust credential stealer. Researchers detailed its persistence and optional root-level eBPF rootkit; a second wave used js-digest.

Key points

Community trackers cataloged more than 400 hijacked AUR packages; reported counts vary, and affected-package lists remain incomplete.
Malicious PKGBUILD or install scripts pulled in atomic-lockfile or, in a second wave, js-digest to run payloads during builds.
Researcher Whanos described a Rust stealer targeting browser and app sessions, developer tokens, SSH material, and container credentials.
The payload can establish systemd persistence; its optional eBPF rootkit hides processes and socket inodes only when it already has root and the required capability.
The article says stolen files are sent to temp[.]sh and command-and-control uses a Tor onion service.
Arch maintainers are resetting malicious commits and banning accounts. Users are advised to check affected-package lists, rotate exposed credentials, and reinstall from trusted media if the payload ran as root.

Article Details

Attack Vectors: Attackers adopted abandoned AUR packages and altered their PKGBUILD or .install scripts to install a malicious npm package during builds.
The [email protected] package ran a bundled Linux ELF through a preinstall hook; a second wave used bun install js-digest.
The Rust payload collected developer credentials and session data, sent stolen files over HTTP to temp.sh, and could establish systemd persistence.
When run as root with the required capability, the payload could optionally load an eBPF rootkit that hid its processes and socket inodes and killed debugger-attachment attempts.
Defensive Notes: Check AUR packages installed or updated on or after June 11 against current affected-package lists; the article says those lists are incomplete.
Review build history and caches for npm install atomic-lockfile, bun install js-digest, and src/hooks/deps.
If a flagged package ran, treat credentials and sessions it could access as compromised and rotate them.
Check system and user systemd units, unexpected files under /var/lib/, and /sys/fs/bpf/ for hidden_pids, hidden_names, and hidden_inodes.
If the payload ran as root, reinstall from trusted media; the article says package removal cannot establish that the host is clean.
Review PKGBUILD files and .install hooks, especially for recently adopted or newly active packages.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`temp[.]sh`	File-upload service to which the malware sends stolen files over HTTP.
SHA256	`6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b`	SHA-256 of the main malicious payload, provided for detection.