Atomic Arch Campaign Reportedly Hijacked 400+ AUR Packages to Deliver Credential-Stealing Malware
Summary
The article reports that attackers modified more than 400 AUR packages to install malicious npm dependencies. The malware targets developer and CI credentials; guidance includes rotating exposed secrets and rebuilding affected hosts.
Key points
- Attackers reportedly adopted orphaned AUR packages and changed build scripts or install hooks to fetch malicious npm dependencies, including atomic-lockfile and js-digest.
- The article describes the payload as a Rust credential stealer targeting browser sessions, SSH keys, developer tokens, messaging sessions, and cloud or container credentials.
- With elevated privileges, the malware can attempt eBPF-based persistence to hide processes and file activity.
- The reported exposure is tied to installing affected AUR packages on Arch Linux or Arch-based systems, including Arch environments in WSL2 and self-hosted Arch CI runners.
- The article says GitHub-hosted runners and non-Arch self-hosted runners are not directly affected by this AUR attack vector unless they use Arch or AUR through another setup.
- Recommended response includes checking AUR installation history, rotating potentially exposed credentials, rebuilding hosts where the payload may have run as root, and monitoring build-host behavior.
Article Details
- Event Type
- Supply-chain attack involving hijacked Arch User Repository packages and malicious npm dependencies.
- Impact
- More than 400 AUR packages were modified to execute attacker-controlled code. The payload targets developer and CI credentials, including browser cookies and session tokens, SSH keys, developer tokens, and cloud credentials; it may also attempt eBPF-based persistence when running with elevated privileges. Arch Linux systems and Arch-based environments using AUR packages are directly affected.
MITRE ATT&CK
T1195.001 · Compromise Software Dependencies and Development ToolsAttackers hijacked trusted AUR packages and injected malicious dependencies, compromising the software supply chain.T1552.004 · Private KeysThe malware targets SSH keys on developer and CI hosts.T1555.003 · Credentials from Web BrowsersThe malware targets browser cookies and session tokens, which the article says may include access to SSO, cloud consoles, and SaaS applications.
Malware
atomic-lockfile2. Inject a malicious dependency. They modified the PKGBUILD or install hooks to run npm install atomic-lockfile (and variants like js-digest), pulling in a malicious Node package.js-digest2. Inject a malicious dependency. They modified the PKGBUILD or install hooks to run npm install atomic-lockfile (and variants like js-digest), pulling in a malicious Node package.
Products
Arch LinuxOn June 11th 2026, security researchers and the Arch Linux community disclosed a large-scale supply-chain attack against the Arch User Repository (AUR). Attackers hijacked more than 400 community packages and turnedArch User Repository (AUR)and the Arch Linux community disclosed a large-scale supply-chain attack against the Arch User Repository (AUR). Attackers hijacked more than 400 community packages and turned them into a malware deliveryEndeavourOSArch Linux and Arch-based distributions (EndeavourOS, Manjaro when AUR is used) where users install AUR packages.ManjaroArch Linux and Arch-based distributions (EndeavourOS, Manjaro when AUR is used) where users install AUR packages.WSL2Windows developers running Arch under WSL2 and installing AUR packages inside that environment - a common setup among developers who want a Linux toolchain on Windows.