Atomic Arch npm Campaign Adds Malicious Dependency

Sonatype researchers disclosed the "Atomic Arch" campaign where attackers compromise abandoned AUR packages by altering PKGBUILDs to pull in a malicious npm dependency (atomic-lockfile). The malicious package contains a Linux payload designed for credential harvesting, stealth/anti-debugging, and potential data exfiltration, representing a supply‑chain threat that leverages existing developer trust.