Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
https://thehackernews.com/2026/06/400-arch-linux-aur-packages-hijacked-to.html
Publish Date: 2026-06-12 15:24:00
Source Domain: thehackernews.com
Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them.
The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself. The AUR is Arch Linux’s community package collection, and it is separate from the official Arch repositories, which were not affected.
If you installed or updated an AUR package on or after June 11, check it against the current affected-package lists before trusting the host. The list of names is large, still growing, and not yet complete.
This attack goes after the trust model, not a software flaw. The compromised packages kept their names, their histories, and the trust that came with them. Only the build instructions changed.
The trap sat in the recipe, leaving the package itself looking exactly like the software users meant to install. No exploit, no zero-day, and no sign Arch’s own systems were breached.
The attackers adopted abandoned packages, edited the build files, and let users run the payload for them. Sonatype, which named the campaign Atomic Arch, found them going after orphaned projects: packages whose maintainers had walked away, leaving them open for anyone to adopt.
They also spoofed git commit metadata so the changes looked like they came from a long-standing maintainer, an account an Arch Linux Trusted User later confirmed was never compromised.
Once a package was adopted, its PKGBUILD or .install script was edited to run npm install atomic-lockfile during the build, pulling the malicious npm package alongside a couple of legitimate ones for cover. That package, [email protected], carries a preinstall hook that runs a bundled Linux ELF named deps. Build the package, and the binary runs.
Confirmed examples reported to the Arch mailing list include the alvr and premake-git packages.
