discovered
Second-stage npm package pulled by 400+ trojanized AUR PKGBUILDs in the Atomic Arch campaign. Carries a preinstall hook (./src/hooks/deps) that executes a 3,040,376-byte stripped Rust-async Linux ELF64 (PIE) infostealer with an eBPF kernel rootkit (scales.bpf.c), Tor hidden-service C2, systemd persistence, and a secondary suspected-cryptominer payload. Same atomic-* naming and implant tradecraft as IronWorm's atomic-notes.