Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware

Lxer • June 13, 2026

The Arch Linux User Repository "AUR" was hit by a large-scale malware campaign this week with more than 400 of these user-supplied packages being compromised... Full Story

« Return to the newswire homepage

This topic does not have any threads posted yet! You cannot post until you login .

You cannot post until you login .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Over 400 Arch Linux AUR Packages Compromised in Supply Chain Attack A significant supply chain attack has compromised over 400 packages in the Arch User Repository (AUR), with attackers injecting malicious build scripts that deploy credential-stealing malware and rootkits. The campaign, dubbed 'Atomic Arch', was identified around June 11, 2026, and exploits the AUR's mechanism for adopting orphaned packages. Attackers spoofed trusted publishers to modify package descriptions, adding dependencies for the npm package 'atomic-lockfile', which contains a Linux ELF payload capable of stealing sensitive information. The Arch Linux community is actively working to delete malicious updates and ban the accounts involved. Users are advised to treat affected systems as compromised and to monitor for unusual activity. The incident underscores the risks associated with community-maintained repositories. 20 sources 69

Extracted Entities

Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Platforms (2)