{"id":271378,"date":"2026-06-12T13:03:00","date_gmt":"2026-06-12T17:03:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/06\/12\/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer\/"},"modified":"2026-06-12T13:15:23","modified_gmt":"2026-06-12T17:15:23","slug":"over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/06\/12\/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer\/","title":{"rendered":"Over 400 Arch Linux packages compromised to push rootkit, infostealer"},"content":{"rendered":"<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer\/\">Over 400 Arch Linux packages compromised to push rootkit, infostealer<\/a><\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer\/\">https:\/\/www.bleepingcomputer.com\/news\/security\/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer\/<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-06-12 13:03:00<\/a><\/p>\n<p>Source Domain: <a href=\"www.bleepingcomputer.com\">www.bleepingcomputer.com<\/a><\/p>\n<p style=\"text-align:center\">\n<p>More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens.<\/p>\n<p>A report from the open-source intelligence community Independent Federated Intelligence Network (IFIN) notes that a new maintainer is spoofing a trusted publisher on the AUR platform to push infected packages.<\/p>\n<p>The Arch Linux distribution is popular among power users and developers, using the AUR catalog to provide the latest versions for installed software, drivers, and the kernel.<\/p>\n<p> <img decoding=\"async\" src=\"https:\/\/www.bleepstatic.com\/c\/w\/state-of-ai-report-970.jpg\" alt=\"image\" style=\"margin-top: 0px;\"\/><\/p>\n<p>AUR is a community-maintained repository for the Arch distribution that contains package build scripts (PKGBUILDs) with instructions for downloading, compiling, and installing software not available in Arch\u2019s official repositories.<\/p>\n<p>AUR is considered essential for any Arch-based distribution because it contains proprietary applications, beta\/nightly versions of open-source software, niche utilities, and older versions of packages that retain functionality which may have been removed in later releases.<\/p>\n<p>However, it is not a vetted space, and threat actors can use it to push malware through packages that change ownership without anyone noticing.<\/p>\n<p>According to IFIN member Michael Taggart, the compromised packages are modified with preinstall scripts that download and execute a malicious npm package called atomic-lockfile.<\/p>\n<p>Independent security researcher Whanos notes that one sample of the atomic-lockfile included a Linux ELF payload named deps, which was a &#8220;credential stealer with optional root-only eBPF [extended Berkeley Packet Filter] rootkit capabilities.&#8221;<\/p>\n<p>&#8220;It is designed for developer workstations and build environments. It targets browser and Electron application data, Slack, Microsoft Teams, Discord, GitHub, npm, Vault, Docker\/Podman, SSH, VPN material, shell histories, and other local developer secrets,&#8221; Whanos says in the report.<\/p>\n<p>With eBPF technology present, the malware can run inside the kernel&#8230;<\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Over 400 Arch Linux packages compromised to push rootkit, infostealer https:\/\/www.bleepingcomputer.com\/news\/security\/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer\/ Publish Date: 2026-06-12 13:03:00&#8230;<\/p>\n","protected":false},"author":1,"featured_media":271379,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.bleepstatic.com\/content\/hl-images\/2025\/07\/18\/arch-linux-white.jpg","fifu_image_alt":"","footnotes":""},"categories":[48],"tags":[99,36,71,32,57],"class_list":["post-271378","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","tag-arch-linux","tag-infostealer","tag-linux","tag-malware","tag-security"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/271378"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=271378"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/271378\/revisions"}],"predecessor-version":[{"id":271380,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/271378\/revisions\/271380"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/271379"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=271378"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=271378"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=271378"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}