400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers

HomeCyber Attack News 400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers By Guru Baran June 12, 2026 A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems. The campaign, dubbed “Atomic Arch” by researchers, was identified around June 11, 2026, and represents one of the most wide-scale AUR incidents on record. The threat actors systematically targeted orphaned AUR packages legitimate projects that have been abandoned by their original maintainers and claimed ownership of them through AUR’s standard adoption process. Once in control, attackers modified the packages’ PKGBUILD scripts, which are the build instruction files that AUR helpers like yay and paru execute during installation. The malicious PKGBUILDs were altered to silently fetch and install two rogue npm packages: atomic-lockfile and js-digest. These packages acted as the primary malware delivery mechanism, executing during the standard package build process without triggering obvious warnings to end users. AUR Packages Compromised With Infostealers Once installed, the malicious npm packages deployed a multi-stage infostealer payload engineered to exfiltrate a broad range of sensitive data, including: Browser credentials — saved passwords, session cookies, and autofill data from Chromium and Firefox-based browsers. SSH private keys — enabling attackers to pivot to remote servers and infrastructure System environment variables — potentially exposing API tokens, cloud credentials, and application secrets Cryptocurrency wallet data — targeting local wallet files and seed phrases. Beyond data theft, the malware employed rootkit-style persistence techniques, disguising its active processes as legitimate kernel threads to evade detection by standard process monitors like ps and htop. This tactic makes post-infection identification significantly harder without dedicated forensic tooling. The Arch Linux security team responded rapidly once the compromise was surfaced on the AUR mailing list. Maintainers reverted malicious PKGBUILD commits, permanently banned the offending attacker accounts, and published a detailed checklist of affected packages for the community. Critically, Arch’s official repositories ([core], [extra], [multilib]) remained unaffected, as those are subject to stricter review processes. Users who regularly install AUR packages should take the following steps immediately: Run pacman -Qm to list all foreign (AUR) packages installed on your system and cross-reference against the published list of compromised packages Audit recent PKGBUILD history for any packages installed between June 10–12, 2026 Rotate all credentials — browser passwords, SSH keys, API tokens, and cloud access keys — if any flagged package was installed Scan for suspicious processes masquerading as kernel threads using tools like rkhunter or chkrootkit Consider using AUR helpers with PKGBUILD review prompts enabled by default. This incident echoes a growing trend of supply chain attacks targeting package repositories across ecosystems. Researchers at Sonatype specifically characterized the Atomic Arch campaign as a deliberate strategy of targeting orphaned, trusted packages with existing install bases, maximizing victim reach while minimizing scrutiny. The AUR’s community-trust model, while a strength for package availability, continues to present a systemic risk that individual vigilance cannot fully mitigate without structural policy changes around orphan package adoption. Follow us on Google News, LinkedIn, and X to Get More Instant Updates. Tags cyber security cyber security news Copy URL Linkedin Twitter ReddIt Telegram Guru Baranhttps://cybersecuritynews.com Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Trending News CISA Warns of Linux Kernel Improper Authentication Vulnerability Exploited in Attacks 21 0-Day Vulnerabilities in FFmpeg Enables Remote Code Execution Attacks Critical Langflow Vulnerability Exploited to Execute Malicious Code North Korea-Aligned Hackers Abuse GitHub Repositories to Infect Developers Ivanti Endpoint Manager Mobile Vulnerability Enables Remote Code Execution Attacks Latest News Cyber Security News SHEETCREEP C# RAT Abuses Google Sheets API as C2 to Target Diplomatic Organizations Cyber Security News Authorities Dismantle Cryptocurrency Laundering Services ‘AudiA6’ Used by Ransomware Gangs Cyber Security News Hackers Use Free Spotify Premium Hacks on TikTok and Instagram to Spread Vidar Infostealer Cyber Security News Solana FakeFix Campaign Uses 25 Malicious npm and PyPI Packages to Steal Developer Secrets Cyber Security News Microsoft Outlook and Word Vulnerabilities Allow Attackers to Execute Malicious Code