Atomic Arch: Attackers Hijack Trusted AUR Packages to Deliver Rootkit-Like Malware

2026-06-15

Attackers are taking over abandoned Arch User Repository packages, changing PKGBUILDs to install a malicious npm dependency called atomic-lockfile that drops a native Linux payload with eBPF-based rootkit behavior, credential and token harvesting, anti-debugging, and HTTP exfiltration. The campaign now appears to touch around 1,500 AUR packages across multiple waves using npm and Bun installers.