MalwarePublished 12 Jun 2026

Over 400 Arch Linux packages compromised to push rootkit, infostealer

Source Bleeping Computer

linux

Description

More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens. [...]

Impact

The malware compromises developer workstations by stealing a wide range of sensitive credentials and tokens used for authentication and access to critical systems and services. The eBPF rootkit enables stealthy persistence by hiding malicious processes and network activity, making detection and removal difficult. This can lead to unauthorized access, data exfiltration, and further compromise of development and production environments. The scale of the compromise (over 400 packages) increases the risk of widespread infection among Arch Linux users relying on AUR packages.

Defensive guidance

Arch Linux maintainers are actively removing malicious commits and banning accounts responsible for pushing infected packages. Users should review the list of affected packages and use community-provided detection scripts to check for the atomic-lockfile malware. If infection is confirmed, users should rotate all credentials and consider reinstalling their Arch Linux system from scratch, as the rootkit may survive standard cleaning. It is recommended to only install packages from trusted and actively maintained projects. Monitor official Arch Linux advisories and community channels for updates.

References

bleepingcomputer.com/news/security/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Jun 2026, 17:09 UTC

References

Community reviews

Related threats