June 2026 supply chain attack against the Arch User Repository (AUR), named 'Atomic Arch' by Sonatype. Attackers adopted 400+ orphaned AUR packages (byteiota counts 408; community lists consolidate ~588) via AUR's standard adoption process and impersonated a trusted maintainer (account arojas, with krisztinavarga and wave-2 accounts custodiatovar/veramagalhaes), then poisoned each PKGBUILD so the build run by yay/paru pulls a malicious npm package ([email protected]) or, in a later variant, js-digest via bun (publisher herbsobering). The npm preinstall hook (./src/hooks/deps) executes a stripped Rust-async Linux ELF infostealer carrying an eBPF kernel rootkit (scales.bpf.c, hooks getdents64 to hide PIDs/files/sockets), Tor hidden-service C2 (olrh4mibs62l6kkuvvjyc5lrercqg5tz543r4lsw3o6mh5qb7g7sneid.onion, /api/agent) with temp.sh fallback, broad developer-secret + browser harvesting, systemd persistence, and a secondary suspected-cryptominer payload. Assessed HIGH confidence as the same operator/toolkit as IronWorm (shared Rust-async ELF + eBPF rootkit + Tor /api/agent + temp.sh tradecraft and shared atomic-* npm naming), re-targeting the Arch ecosystem via the distro build pipeline. Sonatype-2026-003775, CVSS 8.7.
Objective
Compromise the AUR build pipeline at scale to deliver a native infostealer + eBPF rootkit that harvests developer/cloud/SCM/crypto credentials and establishes persistent, kernel-concealed access on Arch Linux hosts.
Related campaigns
Packages
Indicators
- domain olrh4mibs62l6kkuvvjyc5lrercqg5tz543r4lsw3o6mh5qb7g7sneid.onionindicates
- github_repo fardewoak/nodejs-argoindicates
- url https://temp.shexfiltrates-to
- sha256 6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98bindicates
- md5 42b59fdbe1b72895b2951412222ebf40indicates
- sha256 47893d9badc38c54b71321263ce8178c1abb10396e0aadf9793e61ec8829e204drops
- file_path src/hooks/depsindicates
- file_path scales.bpf.cindicates
- sha256 7883bda1ff15425f2dbe622c45a3ae105ddfa6175009bbf0b0cad9bf5c79b316indicates
Techniques
- ttp T1195.002 Compromise Software Supply Chainuses
- ttp T1059.004 Command and Scripting Interpreter: Unix Shelluses
- ttp T1036 Masqueradinguses
- ttp T1027 Obfuscated Files or Informationuses
- ttp T1014 Rootkituses
- ttp T1562.001 Impair Defenses: Disable or Modify Toolsuses
- ttp T1622 Debugger Evasionuses
- ttp T1543.002 Create or Modify System Process: Systemd Serviceuses
- ttp T1552.001 Unsecured Credentials: Credentials In Filesuses
- ttp T1539 Steal Web Session Cookieuses
- ttp T1217 Browser Information Discoveryuses
- ttp T1041 Exfiltration Over C2 Channeluses
- ttp T1090.003 Proxy: Multi-hop Proxyuses
- ttp T1567.002 Exfiltration to Cloud Storageuses
- ttp T1105 Ingress Tool Transferuses
- ttp T1496 Resource Hijackinguses
