Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Attackers took over greater than 400 packages within the Arch Person Repository (AUR) this week and rewrote their construct scripts to put in a credential stealer on any machine that constructed them.

The malware is a Rust binary constructed to reap developer secrets and techniques. When it lands with root, it could possibly additionally load an eBPF rootkit to cover itself. The AUR is Arch Linux’s neighborhood package deal assortment, and it’s separate from the official Arch repositories, which weren’t affected.

In case you put in or up to date an AUR package deal on or after June 11, verify it towards the present affected-package lists earlier than trusting the host. The checklist of names is massive, nonetheless rising, and never but full.

This assault goes after the belief mannequin, not a software program flaw. The compromised packages saved their names, their histories, and the belief that got here with them. Solely the construct directions modified.

The lure sat within the recipe, leaving the package deal itself trying precisely just like the software program customers meant to put in. No exploit, no zero-day, and no signal Arch’s personal techniques have been breached.

The attackers adopted deserted packages, edited the construct recordsdata, and let customers run the payload for them. Sonatype, which named the marketing campaign Atomic Arch, discovered them going after orphaned initiatives: packages whose maintainers had walked away, leaving them open for anybody to undertake.

Additionally they spoofed git commit metadata so the modifications regarded like they got here from a long-standing maintainer, an account an Arch Linux Trusted Person later confirmed was by no means compromised.

As soon as a package deal was adopted, its PKGBUILD or .set up script was edited to run npm set up atomic-lockfile through the construct, pulling the malicious npm package deal alongside a few respectable ones for canopy. That package deal, atomic-lockfile@1.4.2, carries a preinstall hook that runs a bundled Linux ELF named deps. Construct the package deal, and the binary runs.

Impartial researcher Whanos reverse-engineered the deps payload and describes a Rust credential stealer geared toward developer workstations and construct techniques. It collects:

• Cookies, tokens, and native storage from Chromium-based browsers (Chrome, Edge, Courageous, and plenty of extra)
• Session information from Electron apps, together with Slack, Discord, and Microsoft Groups
• GitHub, npm, and HashiCorp Vault tokens, plus OpenAI/ChatGPT bearer materials and account metadata
• SSH keys, known_hosts, and shell histories
• Docker and Podman credentials and VPN profiles

Stolen recordsdata exit over HTTP to temp.sh. Command and management runs by way of a Tor onion service by way of a neighborhood loopback proxy.

For persistence, it installs a systemd service with Restart=at all times. With root it copies itself underneath /var/lib/ and writes a unit underneath /and many others/systemd/system/; as a traditional consumer it makes use of the house listing and a per-user unit underneath ~/.config/systemd/consumer/. Both manner, it needs to return again.

Early write-ups oversold the eBPF rootkit. It’s non-obligatory, and it solely masses when the binary already has root and the proper functionality. It isn’t used to achieve privileges. When it does activate, it hides the malware’s personal processes, course of names, and socket inodes from normal instruments, utilizing pinned BPF maps named hidden_pids, hidden_names, and hidden_inodes, and it kills makes an attempt to connect a debugger.

That modifications the cleanup recommendation. Eradicating the AUR package deal will not be sufficient as soon as the payload has run. A package deal supervisor can take away the recordsdata it is aware of about. It can not show the machine is clear after a rootkit-capable payload has had an opportunity to execute.

The binary additionally phases a second file tied to monero-wallet-gui that the evaluation flags as a potential, unanalyzed cryptominer. An eBPF rootkit bolted onto a smash-and-grab stealer is uncommon, and it’s why this one is price greater than a shrug.

Scope, and a second wave

Sonatype’s first write-up counted greater than 20 hijacked packages. Inside a day, neighborhood trackers and the Arch aur-general thread had cataloged over 400, with one grasp checklist compiled by grepping the AUR git mirror, placing it round 408, and consolidated lists climbing greater.

The atomic-lockfile npm package deal itself confirmed solely 134 weekly downloads on Socket earlier than it was pulled from the registry, so the true publicity is the AUR construct path moderately than npm installs.

A second wave used bun set up js-digest, pushed from a separate set of accounts that neighborhood trackers hyperlink to the identical npm writer as atomic-lockfile. Its payload is a special binary, a separate ELF by its hash, that the neighborhood additionally flagged as malicious.

How far this wave has unfold remains to be being counted. Early breakdowns listed just a few dozen packages, whereas later grep-based searches of the AUR mirror returned a lot greater numbers which will embody churn as commits are eliminated. Both manner, it’s not a footnote to the primary wave, so verify for each atomic-lockfile and js-digest.

What to do now

Arch maintainers are resetting the malicious commits, banning the accounts, and asking customers to maintain reporting suspect packages within the mailing-list thread.

Deal with the printed affected-package checklist as incomplete. In your finish:

• Examine any AUR package deal put in or up to date on or after June 11 towards the neighborhood package deal lists and detection scripts, which examine your overseas packages towards the known-bad set. Grep latest construct historical past and caches for npm set up atomic-lockfile, bun set up js-digest, and the payload path src/hooks/deps.
• If a flagged package deal ran, deal with the host as credential-compromised. Rotate every part the stealer touches: browser periods, SSH keys, GitHub and npm tokens, Slack, Groups and Discord periods, Vault tokens, Docker and Podman credentials, and any cloud keys.
• Hunt for persistence. Examine for unknown systemd companies (each system models and ~/.config/systemd/consumer/) and sudden recordsdata underneath /var/lib/. Examine /sys/fs/bpf/ for the maps hidden_pids, hidden_names, and hidden_inodes. Evaluation outbound connections to Tor and to add companies.
• If the package deal ran as root, assume the rootkit is current and reinstall from trusted media. There is no such thing as a technique to belief the system in any other case.
• Going ahead, learn the PKGBUILD and any .set up hooks earlier than you construct, particularly for packages lately adopted or all of the sudden lively after lengthy dormancy. If you don’t perceive the construct directions, don’t set up the package deal.

For detection, the principle payload’s SHA-256 is 6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b; the complete indicator set, together with the onion C2 host, is within the ioctl.fail evaluation.

The identical adoption tactic hit an deserted PDF-viewer package deal again in 2018; the 2026 model simply scaled it up, a part of a broader run of supply-chain assaults that hijack orphaned initiatives to inherit belief moderately than typosquatting to trick customers. The affected checklist remains to be incomplete, and no CVE has been assigned; Sonatype tracks the marketing campaign as Sonatype-2026-003775 (CVSS 8.7).

The assault labored as a result of the AUR nonetheless trusts a package deal’s identify and historical past over who’s sustaining it now. A lately adopted package deal, or one which all of the sudden sprouts new set up hooks, now deserves the identical suspicion as a package deal from a stranger.