Attackers compromised more than 400 Arch User Repository packages by altering build scripts to install a Rust credential stealer during package builds. The campaign, tracked as Atomic Arch, also used a second wave with js-digest and targeted developer secrets, system persistence, and optional eBPF rootkit hiding. #AtomicArch #AUR #atomic-lockfile #js-digest #Sonatype-2026-003775...

Over 20 Linux packages were compromised in the Atomic Arch campaign, which abuses AUR ownership transfers to drop rootkit-like malware.

Learn how to use the Arch User Repository (AUR) safely. Discover the lessons from the June 2026 AUR malware attack and protect your Arch Linux system.

Linux eBPF rootkits such as VoidLink, LinkPro, and the Atomic Arch campaign use rare helpers to hide sockets, obscure their own programs, and kill ptrace-based debuggers before the kernel finishes processing them. The article shows that defenders should focus on load-time fingerprinting of eBPF programs because helpers like bpf_probe_write_user(), bpf_override_return(), and bpf_send_signal() reveal malicious intent before the rootkit can conceal itself. #VoidLink #LinkPro #AtomicArch #bpf_probe_write_user #bpf_override_return #bpf_send_signal

Between June 9 and June 17, 2026, attackers abused more than 1,900 orphaned Arch User Repository packages to deliver a fake npm payload called atomic-lockfile that stole developer credentials and could escalate into an eBPF rootkit. The campaign also included bun-based variants, Tor-backed exfiltration, and impersonation of legitimate maintainer identities such as arojas and the herbsobering npm account. #atomic-lockfile #js-digest #nextfile-js #AUR #herbsobering #arojas

Attackers compromised more than 400 Arch User Repository packages and altered their build scripts to deliver the Atomic Arch credential stealer during package builds. The campaign also used the malicious npm package atomic-lockfile and a second wave involving js-digest, with some payloads able to install an optional eBPF rootkit and persistence...

Record Store in Philadelphia, PA