Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Package (Campaign)

Researchers disclosed "Atomic Arch," a supply-chain campaign in which an attacker adopted 400+ abandoned AUR packages and modified their PKGBUILD scripts to install a malicious npm package (atomic-lockfile). The package runs a Linux ELF credential stealer (exfiltrating browser/Electron data, developer and cloud secrets, tokens, SSH keys, container credentials, and Vault tokens), can deploy an eBPF rootkit when run as root, and persists via systemd; the malicious npm packages were removed and AUR packages reverted around June 10–12, 2026, but systems that executed the payload remain compromised.