Arch Linux AUR Malware Campaign Hits Multiple User-Contributed Packages

Lxer • June 12, 2026

Share: View original

Arch contributors are cleaning up a malware incident in the AUR after suspicious updates appeared across several user-maintained packages. Full Story

« Return to the newswire homepage

« Return to the newswire homepage

This topic does not have any threads posted yet! You cannot post until you login .

You cannot post until you login .

You cannot post until you login .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Over 400 Arch Linux AUR Packages Compromised in Supply Chain Attack A significant supply chain attack has compromised over 400 packages in the Arch User Repository (AUR), with attackers injecting malicious build scripts that deploy credential-stealing malware and rootkits. The campaign, dubbed 'Atomic Arch', was identified around June 11, 2026, and exploits the AUR's mechanism for adopting orphaned packages. Attackers spoofed trusted publishers to modify package descriptions, adding dependencies for the npm package 'atomic-lockfile', which contains a Linux ELF payload capable of stealing sensitive information. The Arch Linux community is actively working to delete malicious updates and ban the accounts involved. Users are advised to treat affected systems as compromised and to monitor for unusual activity. The incident underscores the risks associated with community-maintained repositories. 20 sources 69

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

T1195 - Supply Chain Compromise

Platforms (1)