400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers

Cybersecuritynews •Guru Baran • June 12, 2026

A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems. The campaign, dubbed “Atomic Arch” by researchers, was identified around June 11, 2026, and represents one of the most […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Over 400 Arch Linux AUR Packages Compromised in Supply Chain Attack A significant supply chain attack has compromised over 400 packages in the Arch User Repository (AUR), with attackers injecting malicious build scripts that deploy credential-stealing malware and rootkits. The campaign, dubbed 'Atomic Arch', was identified around June 11, 2026, and exploits the AUR's mechanism for adopting orphaned packages. Attackers spoofed trusted publishers to modify package descriptions, adding dependencies for the npm package 'atomic-lockfile', which contains a Linux ELF payload capable of stealing sensitive information. The Arch Linux community is actively working to delete malicious updates and ban the accounts involved. Users are advised to treat affected systems as compromised and to monitor for unusual activity. The incident underscores the risks associated with community-maintained repositories. 20 sources 69

Extracted Entities

400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (2)