"Atomic Arch" supply-chain attack hijacks 400+ AUR packages to drop a credential stealer and eBPF rootkit
Attackers adopted roughly 400 orphaned Arch User Repository (AUR) packages through the AUR's standard disowned-package adoption mechanism, then rewrote their PKGBUILD build scripts to pull a malicious npm dependency, atomic-lockfile, during build (Sonatype, 2026-06-11). On any machine that builds an affected package, the dependency fetches a Rust-compiled Linux ELF that harvests developer secrets — browser profiles, SSH keys, GitHub/npm/cloud and AI-service tokens, messaging session data, shell histories, Docker and VPN credentials. When it runs with root or CAP_BPF/CAP_SYS_ADMIN, an embedded eBPF component pins maps at /sys/fs/bpf/hidden_pids, /sys/fs/bpf/hidden_names and /sys/fs/bpf/hidden_inodes to hide its processes, files and socket inodes from ps, ls, netstat and live-response tooling (ioctl.fail, 2026-06-11). A second wave on 12 June added js-digest/lockfile-js delivery packages and a Bun-based path; Sonatype tracks it as Sonatype-2026-003775 (CVSS 8.7) and estimates the campaign may reach ~1,500 packages (BleepingComputer, 2026-06-12). Maps to T1195.002 (Compromise Software Supply Chain) and T1059 (Command and Scripting Interpreter via PKGBUILD).
Why it matters to us: Developer workstations and CI runners that build AUR packages are the blast radius. Hunt for npm install/bun install spawned from makepkg (Sysmon for Linux EID 1, parent-image filter), enumerate ls /sys/fs/bpf/hidden_* across Linux developer hosts, and restrict AUR-helper use on privilege-holding CI runners.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1195.002Supply Chain Compromise: Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Execution TA0002
T1059Command and Scripting Interpreter
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.