Atomic Arch Campaign Hijacks 400+ AUR Packages to Deploy Rust Credential Stealer

Summary

The Atomic Arch campaign altered more than 400 AUR packages to run credential-stealing payloads during builds. Researchers describe an optional eBPF rootkit requiring root access; users are advised to check affected packages, rotate secrets, and reinstall if the payload

Key points

Attackers reportedly altered build scripts in more than 400 Arch User Repository packages, targeting abandoned projects and exploiting package trust rather than a software flaw.
The first wave used the malicious npm package atomic-lockfile; a separate wave used js-digest. Reported examples include alvr and premake-git.
Researcher Whanos reverse-engineered a Rust payload that targets browser and Electron session data, developer tokens, SSH keys, container credentials, VPN profiles, and shell histories.
The payload can establish systemd persistence and send stolen files over HTTP to temp[.]sh; command and control uses a Tor onion service.
An optional eBPF rootkit requires the payload to already have root access and the necessary capability; it is not used to gain privileges.
The affected-package lists remain incomplete. Arch maintainers are resetting malicious commits and banning accounts; users are advised to check packages built or updated since June 11 and rotate exposed credentials.
The article recommends reinstalling from trusted media if the payload ran as root, because removing the package alone cannot establish that the system is clean.

Article Details

Attack Vectors: Attackers adopted abandoned AUR packages and altered their PKGBUILD or .install scripts to run npm install atomic-lockfile during package builds; an [email protected] preinstall hook then ran the bundled Linux ELF named deps.
A second wave used bun install js-digest in another set of packages. Community trackers linked the separate accounts to the same npm publisher, but the article says the wave's spread is still being counted.
The attackers spoofed Git commit metadata to make changes appear to come from a long-standing maintainer. An Arch Linux Trusted User reportedly confirmed that the maintainer's account was not compromised.
Defensive Notes: Check AUR packages installed or updated on or after June 11 against current affected-package lists, which the article says are incomplete; check for both atomic-lockfile and js-digest.
Review recent build history and caches for npm install atomic-lockfile, bun install js-digest, and the payload path src/hooks/deps.
If a flagged package ran, treat the host as credential-compromised and rotate affected browser sessions, SSH keys, developer tokens, messaging sessions, Vault tokens, container credentials, and cloud keys.
Check for unknown systemd services, unexpected files under /var/lib/, and the eBPF maps hidden_pids, hidden_names, and hidden_inodes; review outbound connections to Tor and upload services.
If the package ran as root, the article recommends reinstalling from trusted media. Review PKGBUILD and .install hooks before building packages, especially recently adopted or newly active ones.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`temp[.]sh`	The article says the malware exfiltrates stolen files over HTTP to this upload service.
SHA256	`6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b`	SHA-256 hash identified in the article as the main credential-stealer payload.