'Atomic Arch' supply-chain attack hijacks 400+ Arch Linux AUR packages to deploy a credential stealer and eBPF rootkit

On 11 June 2026, supply-chain security researchers at Sonatype disclosed Atomic Arch, a campaign that hijacked hundreds of packages in the Arch User Repository (AUR) — the community-maintained collection of build recipes that Arch Linux users routinely compile and install on their own machines. Rather than exploit a server-side flaw, the attackers abused the AUR's trust model: they adopted orphaned packages whose original maintainers had walked away, then rewrote the build scripts to pull in malware during installation.

What happened

Once an orphaned project was adopted, its PKGBUILD or .install script was edited to run npm install atomic-lockfile during the build. The malicious npm package, atomic-lockfile@1.4.2, carried a preinstall hook that executed a bundled Linux ELF binary named deps — a credential stealer that, on systems where it ran as root, could load a second-stage eBPF payload (a code file named scales.bpf.c) to gain rootkit-like stealth. To make the tampering look legitimate, the attackers spoofed git commit metadata so the changes appeared to come from a long-standing maintainer; an Arch Linux Trusted User later confirmed the impersonated account had never actually been compromised.

The stealer was built for developer workstations and build environments. Reported targets included browser and Electron application data, Slack, Microsoft Teams, Discord, GitHub and npm credentials, HashiCorp Vault material, Docker and Podman configuration, SSH keys, VPN material, and shell histories.

Impact

• More than 400 AUR packages were confirmed hijacked, with one community master list reaching roughly 408 entries and consolidated lists climbing higher as the investigation continued.
• The malicious atomic-lockfile npm package had only a small footprint — on the order of 134 weekly downloads before it was pulled from the registry.
• Sonatype tracks the campaign as Sonatype-2026-003775, assigning it a CVSS score of 8.7; no CVE has been issued.
• A second wave on 12 June switched to Bun-based installation paths, indicating the operators were actively iterating to evade detection.

Why it matters

The AUR is explicitly community-curated and carries a standing warning that users review build scripts before installing — but in practice, a package's name and history are trusted far more than whoever maintains it today. Atomic Arch turns that gap into a delivery channel: an abandoned package that suddenly sprouts new install hooks now deserves the same suspicion as one from a stranger. The choice of victims is also telling. By targeting Linux developer machines — full of SSH keys, cloud credentials, and source-control tokens — the operators positioned themselves to pivot from a single compromised workstation into the software and infrastructure those developers maintain.