Atomic Arch: Part 2 - Technical Deep Dive

This is the technical continuation of the Atomic Arch analysis. Here, I'll provide the actual source code and detailed reverse engineering notes for the atomic-lockfile package.

⚠️ WARNING: The following contains LIVE MALWARE. Do not execute or download unless you are in a secure, isolated environment. The author takes NO responsibility for any damage caused by misuse.

How I Obtained the Package

The original atomic-lockfile@1.4.2 and nextfile-js@1.4.2 packages were quickly removed from the official npm registry after discovery. However, they remained accessible via Chinese mirrors:

• https://registry.npmmirror.com/nextfile-js/-/nextfile-js-1.4.2.tgz
• This mirror retained the original tarball even after npm removed it
• The file contains the exact same malicious code as atomic-lockfile

Package Structure Analysis

Both packages (atomic-lockfile and nextfile-js) are structurally identical. Here's the layout:

atomic-lockfile/
├── package.json          # Contains "preinstall": "./src/hooks/deps"
├── README.md             # Looks like a legitimate file-locking library
├── src/
│   └── hooks/
│       └── deps          # ELF binary (the actual malware)
└── dist/                 # Normal-looking compiled code

The Pivotal File: package.json

The trigger for the entire attack is in the package.json scripts section:

"scripts": {
    "preinstall": "./src/hooks/deps"
}

This hook executes immediately when the package is installed via npm. No user interaction is required.

The Payload: deps (ELF Binary)

The malicious binary is a stripped, 64-bit Linux ELF written in Rust. Its key characteristics:

• SHA256: 6144D433F8A0316869877B5F834C801251BBB936E5F1577C5680878C7443C98B
• Size: ~1.2MB stripped
• Language: Rust (compiled with standard library)
• Packer: None detected
• Anti-analysis: Stripped symbols, debugger detection

Key Functions Identified:

• Credential theft: Functions for parsing Chrome/Chromium cookie databases, Discord token extraction, and SSH key enumeration
• Persistence: Systemd service creation (both user and system mode)
• eBPF loading: BPF bytecode injection for kernel-level hiding
• Exfiltration: HTTPS uploads with multipart/form-data
• C2 communication: Tor SOCKS5 proxy support

Community Tools

Several detection tools have been developed by the community:

• lenucksi/aur-malware-check: Bash script for scanning system for infected packages and artifacts. Includes --all-time, --check-bun-cache, and --refresh flags.
• arbaes Atomic Arch Scanner: Original detection script used as the basis for many forks.
• Python version: A Python 3.14+ rewrite of the detection logic (in the aur-check-python directory).

All tools are available at: github.com/lenucksi/aur-malware-check

IOCs (Indicators of Compromise)

• npm packages: atomic-lockfile, lockfile-js, nextfile-js
• ELF payload hash: 6144D433F8A0316869877B5F834C801251BBB936E5F1577C5680878C7443C98B
• C2 infrastructure: Tor onion service (decoded at runtime)
• Exfiltration URL: temp.sh (file sharing service)
• Attacker npm accounts: herbsobering, uquque
• AUR attacker accounts: krisztinavarga, franziskaweber, tobiaswesterburg, ellenmyklebust, custodiatovar, veramagalhaes

Detection Commands

Run these on any potentially affected system:

# Check for infected AUR packages
curl -s https://raw.githubusercontent.com/lenucksi/aur-malware-check/master/aur_check-v2.sh | bash

# Or, manually scan for npm cache leftovers
find ~/.npm -name "*atomic-lockfile*" -type d 2>/dev/null

# Check for systemd persistence
systemctl list-units --type=service --state=running | grep -E "atomic|nextfile|lockfile"

# Check for eBPF rootkit maps (requires root)
sudo bpftool map list | grep -E "hidden_(pids|names|inodes)"

Mitigation & Recovery Steps

1. Immediate: Rotate ALL credentials (SSH keys, API tokens, passwords, session cookies).
2. Detection: Run the community detection scripts to identify infected packages.
3. Removal: Remove affected AUR packages and npm caches.
4. Persistence: Check for and remove any suspicious systemd units.
5. Full recovery: If rootkit or persistence is found, perform a clean OS reinstall from trusted media.
6. Long-term: Adopt practices like reviewing PKGBUILD diffs and using npm install --ignore-scripts for manual installs.

References & Further Reading

• Sonatype Blog: Atomic Arch npm Campaign
• ioctl.fail: Preliminary Analysis
• IFIN Discourse: Full Incident Thread
• GitHub: lenucksi/aur-malware-check
• Part 1 - The Discovery (Back to overview)

This concludes the technical analysis of the Atomic Arch campaign. The source code is available for research purposes only at blog.unionium.org/atomic.tgz.

Yours, Ley.