Atomic Arch: Part 1 - The Discovery

On June 10, 2026, the Arch Linux community was shaken by one of the most sophisticated supply chain attacks in its history.

The attack, later dubbed "Atomic Arch", targeted the Arch User Repository (AUR) and compromised over 1,500 packages within days. At the center of it all was a seemingly harmless npm library called atomic-lockfile.

The Attack Vector

Attackers didn't create malicious packages from scratch. Instead, they exploited a fundamental flaw in the AUR's trust model: package ownership inheritance.

• They identified orphaned AUR packages and requested maintenance rights
• Once approved, they injected malicious code into PKGBUILD and .install files
• The injection added npm install atomic-lockfile or npm install lockfile-js to the build process
• To avoid suspicion, they used git commit forgery to impersonate legitimate maintainers like arojas
• This made the attacks appear as legitimate updates from trusted developers

The Malicious Package

The npm package atomic-lockfile@1.4.2 looked completely legitimate:

• Comprehensive README with detailed documentation
• MIT license
• Professional structure with TypeScript, ESM/CJS support, CLI tools, and middleware
• Published by a fake account (herbsobering) with a realistic-sounding name

However, hidden inside package.json was the key difference:

"preinstall": "./src/hooks/deps"

This innocent-looking hook executed an ELF binary named deps (SHA256: 6144D4...)

What the Malware Actually Does

1. Credential Theft

• Discord tokens, GitHub PATs, and npm tokens
• Slack, Microsoft Teams, and M365 sessions
• SSH keys, HashiCorp Vault tokens
• Docker and Podman credentials
• Browser cookies and saved passwords

2. Advanced Capabilities

• Data exfiltration: Uploads stolen data to temp.sh and communicates with C2 via Tor onion services
• Persistence: Creates systemd services with Restart=always (in /etc/systemd/system/ as root, or ~/.config/systemd/user/ as a normal user)
• eBPF rootkit: When run with CAP_BPF privileges, it loads kernel-level rootkits to hide processes, files, and socket inodes from system monitoring tools
• Cryptominer staging: References /usr/bin/monero-wallet-gui as a potential crypto mining payload location

The Impact and Response

• June 10, 2026: First malicious packages published
• June 11: Community discovered the scope; over 400 packages initially identified
• June 12: Second wave detected using bun install js-digest to bypass initial detection
• June 12: Arch Linux developers began cleaning infected packages and banning attacker accounts
• June 15: AUR temporarily suspended new account registrations to stop the flow of malicious packages
• By June 17: Over 1,600 packages were confirmed compromised

How to Protect Yourself

• Check your system: Run the community detection script from lenucksi/aur-malware-check
• If you're infected: Rotate ALL credentials accessible from that machine; check for unknown systemd services; run sudo bpftool map list for hidden eBPF maps
• Long-term: Review PKGBUILD and .install files before building; consider using npm install --ignore-scripts for manual installations

For Technical Analysis

For the full technical deep dive, including the actual source code, reverse engineering notes, and IOC analysis, see Part 2 - Technical Deep Dive.

This is not a hoax. The Atomic Arch campaign represents a significant shift in how supply chain attacks target developers. The AUR is not the first target, and it won't be the last.

Stay vigilant. Review your packages. Protect your credentials.

Yours, Ley.