Over 400 AUR Packages Weaponized to Deliver Rootkit and Credential-Stealing Malware

A coordinated supply-chain attack has compromised more than 400 packages in the Arch User Repository (AUR), using two distinct delivery techniques to drop credential-stealing malware with optional kernel-level rootkit functionality onto developer machines.

According to researchers at the open-source intelligence group Independent Federated Intelligence Network (IFIN), a new maintainer has been impersonating a well-known AUR publisher to inject malicious pre-install scripts into packages. Those scripts reach out to npm and pull down a package called atomic-lockfile during installation.

Separately, supply-chain security firm Sonatype documented a related but mechanically different method: the same attacker claimed ownership of at least 20 orphaned AUR packages and altered their PKGBUILD scripts — the Bash-based build definitions Arch uses — to invoke npm post-install and fetch atomic-lockfile.

Both paths lead to the same payload. Independent security researcher Whanos analyzed a sample of atomic-lockfile and identified a Linux ELF binary called deps inside it.

"It is designed for developer workstations and build environments. It targets browser and Electron application data, Slack, Microsoft Teams, Discord, GitHub, npm, Vault, Docker/Podman, SSH, VPN material, shell histories, and other local developer secrets." — Whanos, via IFIN report

Sonatype's analysis corroborated the scope: the binary can collect GitHub credentials, SSH artifacts, HashiCorp Vault tokens, browser cookie databases, and data from Slack, Discord, Microsoft Teams, and Telegram. It also supports archiving collected data, splitting it into multi-part files, and exfiltrating it over HTTP — a complete exfiltration pipeline in a single binary.

The eBPF component raises the severity considerably. When running with root privileges, it can conceal processes, files, and network interfaces inside the kernel, making detection with standard tooling unreliable and complicating post-incident cleanup.

AUR maintainers are actively working to identify and remove malicious commits and ban associated accounts. Arch Linux package maintainer Jonathan Grotelüschen has called on community members to report any suspicious packages they encounter. IFIN member Michael Taggart has published a script that checks a running system for atomic-lockfile artifacts, and a list of affected packages with indicators of compromise is available in the Whanos report.

The incident illustrates the compounding risk of community repositories that lack mandatory code review: package ownership transfers are a low-friction vector for injecting malware into the supply chains of organizations that depend on AUR for niche tooling, proprietary drivers, or pre-release software versions. Teams that automate AUR installs in CI pipelines without auditing PKGBUILD changes are particularly exposed.