Atomic Arch Campaign Hijacks 20+ Linux AUR Packages to Deliver Malware

Sonatype researchers uncovered the "Atomic Arch" supply-chain campaign targeting the Arch User Repository (AUR): attackers claim abandoned packages, alter PKGBUILD build scripts to run a malicious npm dependency (atomic-lockfile), and deliver a native Linux binary that uses eBPF to hide, gain persistence, and exfiltrate credentials (GitHub keys, SSH, Vault tokens, browser cookies, and messaging app data). Over 20 AUR packages are reported compromised, the malware is tracked as Sonatype-2026-003775 (CVSS 8.7), and simple removal of the visible package may not remediate systems once the second‑stage payload is active.