Over 400 Arch Linux AUR Packages Compromised in 'Atomic Arch' Supply Chain Attack Deploying Infostealers
Attackers hijacked over 400 orphaned Arch User Repository packages in the 'Atomic Arch' campaign, injecting malicious npm packages that deploy infostealers targeting browser credentials, SSH keys, and cryptocurrency wallets.
A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems. The campaign, dubbed "Atomic Arch" by researchers, was identified around June 11, 2026, and represents one of the most wide-scale AUR incidents on record.
The threat actors systematically targeted orphaned AUR packages — legitimate projects that have been abandoned by their original maintainers — and claimed ownership of them through AUR's standard adoption process. Once in control, attackers modified the packages' PKGBUILD scripts, which are the build instruction files that AUR helpers like yay and paru execute during installation. The malicious PKGBUILDs were altered to silently fetch and install two rogue npm packages: atomic-lockfile and js-digest. These packages acted as the primary malware delivery mechanism, executing during the standard package build process without triggering obvious warnings to end users.
Once installed, the malicious npm packages deployed a multi-stage infostealer payload engineered to exfiltrate a broad range of sensitive data, including browser credentials (saved passwords, session cookies, and autofill data from Chromium and Firefox-based browsers), SSH private keys, system environment variables (potentially exposing API tokens, cloud credentials, and application secrets), and cryptocurrency wallet data (targeting local wallet files and seed phrases). Beyond data theft, the malware employed rootkit-style persistence techniques, disguising its active processes as legitimate kernel threads to evade detection by standard process monitors like ps and htop. This tactic makes post-infection identification significantly harder without dedicated forensic tooling.
The Arch Linux security team responded rapidly once the compromise was surfaced on the AUR mailing list. Maintainers reverted malicious PKGBUILD commits, permanently banned the offending attacker accounts, and published a detailed checklist of affected packages for the community. Critically, Arch's official repositories (core, extra, multilib) remained unaffected, as those are subject to stricter review processes.
Users who regularly install AUR packages should take immediate steps: run pacman -Qm to list all foreign (AUR) packages installed on their system and cross-reference against the published list of compromised packages; audit recent PKGBUILD history for any packages installed between June 10–12, 2026; rotate all credentials — browser passwords, SSH keys, API tokens, and cloud access keys — if any flagged package was installed; scan for suspicious processes masquerading as kernel threads using tools like rkhunter or chkrootkit; and consider using AUR helpers with PKGBUILD review prompts enabled by default.
This incident echoes a growing trend of supply chain attacks targeting package repositories across ecosystems. Researchers at Sonatype specifically characterized the Atomic Arch campaign as a deliberate strategy of targeting orphaned, trusted packages with existing install bases, maximizing victim reach while minimizing scrutiny. The AUR's community-trust model, while a strength for package availability, continues to present a systemic risk that individual vigilance cannot fully mitigate without structural policy changes around orphan package adoption.
New reporting from the Independent Federated Intelligence Network (IFIN) and Sonatype reveals that the attackers used two distinct methods to compromise the packages: some were hijacked by a maintainer spoofing a trusted publisher, while others were orphaned packages taken over and modified with post-install scripts that invoke npm to retrieve the atomic-lockfile malware. The malicious npm package delivers a Linux ELF payload named deps, which combines eBPF rootkit capabilities with credential theft targeting browser data, Slack, Discord, GitHub, npm, Vault, Docker, SSH, and shell histories. Sonatype's analysis confirms the binary can archive data, handle multi-part files, and perform HTTP uploads, indicating a fully functional exfiltration mechanism.
A second wave of the attack uses a separate npm package, bun install js-digest, pushed from different accounts linked to the same publisher as atomic-lockfile. Its payload is a distinct ELF binary that community trackers also flagged as malicious, and the combined scope now exceeds 400 hijacked packages, with the list still growing as Arch maintainers reset commits and ban accounts.
A second wave of the campaign has been identified using a separate malicious npm package, js-digest, installed via bun install, with a distinct ELF binary payload. Community trackers have now cataloged over 400 hijacked packages, up from the initial 20, and the list continues to grow as more compromised packages are discovered. Arch maintainers are resetting malicious commits and banning accounts, but users who built affected packages must treat their systems as fully compromised due to the eBPF rootkit's ability to hide persistence mechanisms.
The scale of the campaign has now escalated well past the initial 400 compromised packages, with Arch Linux disclosing that over 1,500 AUR packages were ultimately affected. On June 14, attackers launched a more sophisticated wave of malicious commits, prompting the team to disable new account registration entirely while cleanup continues. The attackers leveraged malicious npm dependencies to deliver hostile JavaScript payloads through the poisoned AUR packages, further expanding the supply-chain attack's reach.
Arch Linux has now suspended new account registrations on the AUR to stem the tide of malicious uploads, as the Atomic Arch campaign surpassed 1,500 compromised packages by June 11. Sonatype reports that attackers initially targeted orphaned packages with malicious NPM payloads, then shifted to Bun-based installation paths and began publishing entirely new malicious packages. The malware deploys eBPF-based persistence, credential harvesting from SSH, Vault, and browser stores, and file/process hiding, making infected hosts extremely difficult to clean.