Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Back Thehackernews

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Thehackernews • June 12, 2026

Share: View original

Learn how to map hidden AI tools and agents directly to human owners. Join SailPoint to unify human, machine, and AI identities.

Learn how to validate automated pentesting results for accurate security decisions.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Over 400 Arch Linux AUR Packages Compromised in Supply Chain Attack A significant supply chain attack has compromised over 400 packages in the Arch User Repository (AUR), with attackers injecting malicious build scripts that deploy credential-stealing malware and rootkits. The campaign, dubbed 'Atomic Arch', was identified around June 11, 2026, and exploits the AUR's mechanism for adopting orphaned packages. Attackers spoofed trusted publishers to modify package descriptions, adding dependencies for the npm package 'atomic-lockfile', which contains a Linux ELF payload capable of stealing sensitive information. The Arch Linux community is actively working to delete malicious updates and ban the accounts involved. Users are advised to treat affected systems as compromised and to monitor for unusual activity. The incident underscores the risks associated with community-maintained repositories. 20 sources 69

Extracted Entities

Attack Types (2)

Malware Supply Chain Attack

Platforms (1)