cyber.hendryadrian.com
Security News · bleepingcomputer.com

Reports Link More Than 400 AUR Packages to Linux Rootkit and Infostealer

· Original article ↗

Summary

Reports describe AUR packages delivering the atomic-lockfile npm package and Linux malware that targets credentials and developer secrets, with optional eBPF rootkit capabilities. AUR maintainers are working to remove malicious commits.

Key points

  • IFIN reported more than 400 AUR packages distributing malware; attackers allegedly spoofed a trusted publisher and hijacked orphaned packages.
  • The malicious atomic-lockfile package was delivered through preinstall scripts; Sonatype separately described at least 20 hijacked packages using modified PKGBUILD files and post-install scripts.
  • Researchers described a Linux payload targeting browser data, developer credentials, SSH artifacts, Vault tokens, and collaboration tools.
  • The payload reportedly has optional eBPF rootkit capabilities that can hide processes; Sonatype analysis also found data-archiving and HTTP-upload functionality.
  • AUR maintainers are working to identify and remove malicious commits and ban the accounts involved.
  • Users are advised to check affected-package lists and indicators, rotate credentials if compromised, and consider reinstalling Arch.

Article Details

Event Type
Supply-chain compromise and malware distribution through packages in the Arch User Repository (AUR).
Impact
More than 400 AUR packages were reported as compromised or used to distribute the malicious atomic-lockfile npm package and a Linux payload. The reported payload steals credentials, access tokens, browser data, and developer secrets; it also has optional eBPF rootkit capabilities that can hide processes, files, and network interfaces. The article reports exfiltration-related functionality, including archiving data and HTTP uploads, but does not confirm that data was successfully stolen.

People

Jonathan GrotelüschenAn Arch Linux package maintainer who urged community members to report malicious packages.Michael TaggartAn Independent Federated Intelligence Network member who described the compromised packages' preinstall scripts and pointed to a script for checking systems for atomic-lockfile.WhanosAn independent security researcher who analyzed an atomic-lockfile sample and described its credential-stealing functionality and optional eBPF rootkit capabilities.

Products

Arch LinuxAttackers spoofed a trusted publisher and hijacked orphaned packages on Arch Linux.Arch User Repository (AUR)More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens.npmAccording to IFIN member Michael Taggart, the compromised packages are modified with preinstall scripts that download and execute a malicious npm package called atomic-lockfile.

Related Articles