Atomic Arch

campaign · campaign:atomic-arch-aur-supply-chain-2026

AUR supply-chain campaign: 400+ hijacked Arch Linux user-repository packages drop a Rust stealer and an eBPF rootkit.

Coverage timeline

first 2026-06-13 → last 2026-06-13

Peak priority

high

1 high

Sources cited

3 hosts

Sections touched

active-threats

Co-occurring entities

no co-occurrence

ATT&CK techniques

pinned v19.2 · see below

Hunting pivots

ATT&CK techniques

2 techniques observed across 1 entry, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-06-13/atomic-arch-supply-chain-attack-hijacks-400-aur-packages-to · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-06-13/atomic-arch-supply-chain-attack-hijacks-400-aur-packages-to · ATT&CK page ↗

Story timeline

2026-06-13"Atomic Arch" supply-chain attack hijacks 400+ AUR packages to drop a credential stealer and eBPF rootkit
active-threats

Where this entity is cited

active-threats1

Source distribution

bleepingcomputer.com1 (33%)
ioctl.fail1 (33%)
sonatype.com1 (33%)

explore in graph

All cited sources (3)

Entries about Atomic Arch (1)

2026-06-13 · view entry permalink →

HIGH

"Atomic Arch" supply-chain attack hijacks 400+ AUR packages to drop a credential stealer and eBPF rootkit

Attackers adopted roughly 400 orphaned Arch User Repository (AUR) packages through the AUR's standard disowned-package adoption mechanism, then rewrote their PKGBUILD build scripts to pull a malicious npm dependency, atomic-lockfile, during build (Sonatype, 2026-06-11). On any machine that builds an affected package, the dependency fetches a Rust-compiled Linux ELF that harvests developer secrets, browser profiles, SSH keys, GitHub/npm/cloud and AI-service tokens, messaging session data, shell histories, Docker and VPN credentials. When it runs with root or CAP_BPF/CAP_SYS_ADMIN, an embedded eBPF component pins maps at /sys/fs/bpf/hidden_pids, /sys/fs/bpf/hidden_names and /sys/fs/bpf/hidden_inodes to hide its processes, files and socket inodes from ps, ls, netstat and live-response tooling (ioctl.fail, 2026-06-11). A second wave on 12 June added js-digest/lockfile-js delivery packages and a Bun-based path; Sonatype tracks it as Sonatype-2026-003775 (CVSS 8.7) and estimates the campaign may reach ~1,500 packages (BleepingComputer, 2026-06-12). Maps to T1195.002 (Compromise Software Supply Chain) and T1059 (Command and Scripting Interpreter via PKGBUILD).

Why it matters to us: Developer workstations and CI runners that build AUR packages are the blast radius. Hunt for npm install/bun install spawned from makepkg (Sysmon for Linux EID 1, parent-image filter), enumerate ls /sys/fs/bpf/hidden_* across Linux developer hosts, and restrict AUR-helper use on privilege-holding CI runners.

threat13 Jun 05:00Zmulti-sourceOpen finding ↗

Sources: Sonatype · ioctl.fail · BleepingComputer