AUR package-hijacking campaign delivering atomic-lockfile
Campaign
Summary
Hide ▲
Show ▼
AUR package-hijacking campaign is abusing more than 400 compromised Arch User Repository (AUR) packages to deliver atomic-lockfile, turning the AUR build path into a supply-chain route for credential theft and an optional eBPF rootkit. Attackers used orphaned packages, spoofed maintainer metadata, and altered PKGBUILD or .install scripts to run npm install atomic-lockfile during builds; confirmed examples include alvr and premake-git. The payload is a Rust stealer that targets developer secrets such as browser sessions, SSH keys, GitHub and npm tokens, HashiCorp Vault tokens, and desktop app session data, and it can also hide itself when it gains root. Users who installed or updated AUR packages on or after June 11 were told to check against known-bad package lists, rotate exposed credentials, and treat affected hosts as compromised if the package ran.
Related Happenings
AsyncAPI malicious npm package supply-chain malware
Malware Activity
H score21
First: 15.07.2026 18:37
Last: 15.07.2026 18:37
Sources 1
About this happening:
Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...
AsyncAPI malicious npm package supply-chain malware
Malware ActivityAbout this happening: Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...
Compromised @asyncapi npm packages distributing the Miasma loader
Malware Activity
H score29
First: 15.07.2026 12:16
Last: 15.07.2026 12:16
Sources 1
About this happening:
Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....
Compromised @asyncapi npm packages distributing the Miasma loader
Malware ActivityAbout this happening: Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....
Jscrambler 8.14.0 malicious preinstall infostealer release
Malware Activity
H score9
First: 11.07.2026 20:59
Last: 11.07.2026 20:59
Sources 1
About this happening:
The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...
Jscrambler 8.14.0 malicious preinstall infostealer release
Malware ActivityAbout this happening: The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...
OpenMandriva Linux project hit by cyberattack
Incident
H score32
First: 10.07.2026 01:14
Last: 10.07.2026 01:14
Sources 1
About this happening:
The OpenMandriva Linux project is recovering from an attempted internal sabotage that deleted repositories and published an empty package that could have damaged user...
OpenMandriva Linux project hit by cyberattack
IncidentAbout this happening: The OpenMandriva Linux project is recovering from an attempted internal sabotage that deleted repositories and published an empty package that could have damaged user...
Rollup polyfill npm package malware activity for remote access and data theft
Malware Activity
H score16
First: 03.07.2026 19:07
Last: 03.07.2026 19:07
Sources 1
About this happening:
Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
Rollup polyfill npm package malware activity for remote access and data theft
Malware ActivityAbout this happening: Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
Timeline
-
12.06.2026 20:03 4 articles · 1mo ago
AUR package-hijacking campaign pushes atomic-lockfile rootkit and infostealer
Initial DisclosureIndependent Federated Intelligence Network (IFIN) and Sonatype describe an active supply-chain compromise in the Arch User Repository (AUR) where a spoofed maintainer and hijacked orphaned packages use preinstall and post-install scripts to invoke npm and install atomic-lockfile, a Linux rootkit and infostealer that targets developer credentials, access tokens, and local secrets; one sample includes a Linux ELF payload named deps with optional root-only eBPF rootkit capabilities, and Arch Linux maintainers are removing malicious commits while urging users to review affected packages, check indicators of compromise, rotate credentials, and reinstall Arch from scratch if compromise is found.
Show sources
- Over 400 Arch Linux packages compromised to push rootkit, infostealer — www.bleepingcomputer.com — 12.06.2026 20:03
- Over 400 Arch Linux packages compromised to push rootkit, infostealer — www.bleepingcomputer.com — 12.06.2026 20:03
- 400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer — thehackernews.com — 12.06.2026 22:24
- Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit — thehackernews.com — 12.06.2026 22:33