Malware Compromises 400+ Arch Linux AUR Packages

WHO:

The Hacker News - Attackers compromised over 400 packages in the Arch User Repository (AUR).

The Hacker News - Sonatype identified the campaign as Atomic Arch.

The Hacker News - Independent researcher Whanos reverse-engineered the malware.

WHAT:

The Hacker News - More than 400 packages in the AUR were hijacked to deploy a credential stealer and an eBPF rootkit.

The Hacker News - The malware is a Rust binary designed to harvest developer secrets.

The Hacker News - The compromised packages maintained their names and histories, with only the build instructions altered.

The Hacker News - Confirmed examples of compromised packages include alvr and premake-git.

Phoronix - Arch Linux maintainers are working to reset/delete all malicious content and ban affected accounts.

WHERE:

The Hacker News - The attack targeted the Arch User Repository (AUR), which is a community package collection for Arch Linux.

WHEN:

The Hacker News - Users who installed or updated an AUR package on or after June 11 should check against the affected-package lists.

The Hacker News - The atomic-lockfile npm package had only 134 weekly downloads before it was pulled from the registry.

WHY:

The Hacker News - The attack exploited the trust model of the AUR, targeting orphaned packages that had been abandoned by their maintainers.

HOW:

The Hacker News - Attackers adopted abandoned packages and edited their build files to include malicious instructions.

The Hacker News - The malware collects various sensitive data, including cookies, tokens, SSH keys, and session data from applications.

The Hacker News - The malware communicates over HTTP to temp.sh and uses a Tor onion service for command and control.

The Hacker News - The malware installs a systemd service for persistence, ensuring it can restart after being removed.

The Hacker News - The eBPF rootkit is optional and only activates if the binary has root access and the right capability.

(UPDATED June 13, 2026 06:23 UTC)

In a significant cybersecurity breach, attackers have compromised over 400 packages in the Arch User Repository, identified as part of a campaign dubbed Atomic Arch. The hijacked packages, which include confirmed examples like alvr and premake-git, were altered to deploy a credential stealer and an eBPF rootkit, all while maintaining their original names and histories. Arch Linux maintainers are currently working to reset and delete all malicious content, urging users who installed or updated any AUR package on or after June 11 to check against the affected-package lists.