“Atomic Arch”: Over 400 AUR Packages Poisoned in Sweeping Linux Supply Chain Attack

“Atomic Arch”: Over 400 AUR Packages Poisoned in Sweeping Linux Supply Chain Attack

Attackers quietly hijacked abandoned Arch User Repository packages to deliver a credential-stealing infostealer and eBPF rootkit — leaving millions of Arch, Manjaro, and EndeavourOS users at risk.

What Happened

On June 11, 2026, researchers at Sonatype uncovered a sophisticated supply chain campaign they named “Atomic Arch.” Attackers systematically adopted long-orphaned packages in the Arch User Repository — legitimate projects abandoned by their original maintainers — and rewrote their build instructions to silently install malware during a routine package installation or update.

The attack did not touch the official Arch Linux repositories. Packages distributed through the signed, officially maintained channels remain unaffected. The AUR, however, operates on a social trust model: community contributors write PKGBUILD scripts, and users run them with relatively little automated verification. That openness was the attack surface.

A second wave emerged on June 12, 2026, broadening the delivery mechanism beyond the initial npm-based vector. Community analysis has since identified at least 588 confirmed compromised packages in the wild.

How the Attack Worked

Attackers registered AUR accounts and applied through the repository’s standard orphan-adoption process to take ownership of dormant, well-known packages. Once in control, they modified the PKGBUILD post-install scripts to execute a command like npm install atomic-lockfile minimist chalk, pulling a malicious dependency called atomic-lockfile from the public npm registry. The package itself remained visually clean — only the build instructions were altered — causing standard signature-based tools to miss the threat entirely.

A second wave deployed a parallel payload via Bun: packages instructed users’ systems to run bun install js-digest, delivering similar malicious code through a different package manager. Sonatype is tracking the primary malicious dependency as Sonatype-2026-003775 (high-severity CVSS).

The attackers understood the AUR trust model better than most. Rather than breaking into Arch’s own systems — which they didn’t — they went after the weakest point in the chain: orphaned packages.

— Squared Tech analysis

What the Malware Steals

Forensic analysis of the payloads reveals an infostealer written in Rust with rootkit-style capabilities. Targeted data includes:

• SSH private keys
• Browser session cookies
• GitHub & GitLab tokens
• Slack, Discord & Teams sessions
• Cloud provider API keys
• CI/CD pipeline secrets
• GPG keys and Git credentials
• General credential stores

All exfiltrated data is sent outbound over HTTP to temp.sh. Command-and-control infrastructure runs through a Tor onion service via a local loopback proxy, keeping attacker infrastructure largely opaque to defenders.

Persistence & Stealth

The malware installs a systemd service configured with Restart=always, surviving reboots with or without root access. With root privileges it writes to /var/lib/ and /etc/systemd/system/; without root, it uses ~/.config/systemd/user/. An optional eBPF rootkit component — only activated when root and the required Linux capability are already present — hides the malware’s own processes from ps, htop, and similar monitoring utilities, making post-infection identification significantly harder.

Scope & Impact

The AUR is used daily by millions of users running Arch Linux, Manjaro, and EndeavourOS. Many affected packages masqueraded as common developer tools — programming language utilities, text editors, and system monitoring software — meaning the attack disproportionately targeted development environments and CI/CD pipelines where credentials have elevated blast radius.

Unusual network activity and elevated CPU usage were among the first reported symptoms in late May 2026, before the campaign was formally identified and named. The Arch Linux security team responded once the compromise was surfaced on the AUR mailing list, and community contributors rapidly assembled detection scripts consolidating indicators of compromise.

The Bigger Picture

The “Atomic Arch” campaign follows a pattern now familiar from the SolarWinds breach, the XZ utils backdoor, and a string of npm and PyPI poisoning incidents: rather than attacking users directly, attackers compromise the trusted software sources users pull from automatically. The open-source ecosystem’s reliance on volunteer maintainers creates a structural vulnerability — any package that outlives its maintainer’s attention becomes a potential vector.

Sonatype researchers characterised the Atomic Arch strategy as deliberately targeting orphaned packages with existing install bases to maximize victim reach while minimising scrutiny — a scalable, low-noise approach that grows more tractable as AI tools lower the barrier to identifying unmaintained projects at scale.

What to Do Now

AUR users should audit installed packages against the community detection scripts and package list maintained on GitHub. Where possible, prefer official Arch repository equivalents. Before installing any AUR package, manually review the PKGBUILD for suspicious post-install commands, particularly any invocation of npm install or bun install with unfamiliar package names. Implement network monitoring for unexpected outbound connections from Linux systems, and rotate any credentials or keys stored in environments where AUR packages were installed in the past several months.