A threat actor compromised over 400 packages in the Arch User Repository (AUR) by spoofing trusted maintainers and modifying PKGBUILD scripts to include preinstall or post-install commands that fetch and install a malicious npm package called atomic-lockfile. This package contains a Linux ELF payload with credential-stealing functionality and an optional eBPF rootkit that can hide processes, files, and network interfaces. The malware targets sensitive data including GitHub credentials, SSH keys, Vault tokens, browser cookies, and data from Slack, Discord, Microsoft Teams, and Telegram. The attacker hijacked orphaned packages and injected malicious scripts to execute the payload during package installation. The Arch Linux maintainers are working to remove these malicious packages and ban the responsible accounts. Detection scripts and community advisories have been published to help users identify infection.

The malware compromises developer workstations by stealing a wide range of sensitive credentials and tokens used for authentication and access to critical systems and services. The eBPF rootkit enables stealthy persistence by hiding malicious processes and network activity, making detection and removal difficult. This can lead to unauthorized access, data exfiltration, and further compromise of development and production environments. The scale of the compromise (over 400 packages) increases the risk of widespread infection among Arch Linux users relying on AUR packages.

Arch Linux maintainers are actively removing malicious commits and banning accounts responsible for pushing infected packages. Users should review the list of affected packages and use community-provided detection scripts to check for the atomic-lockfile malware. If infection is confirmed, users should rotate all credentials and consider reinstalling their Arch Linux system from scratch, as the rootkit may survive standard cleaning. It is recommended to only install packages from trusted and actively maintained projects. Monitor official Arch Linux advisories and community channels for updates.