35
Malicious Atomic Arch NPM Campaign Thread
(discuss.tchncs.de)
Decided to create a thread for tracking and sharing the news and opinions on the new Malicious Atomic Arch NPM Campaign in which more than 1600 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit.
Find the infected packages: https://md.archlinux.org/s/SxbqukK6IA
Most popular packages on the affected list
Package Popularity Affected Reverted
libgdata 16.98% (2026-06-11 14:59+00:00) (2026-06-11 17:30+00:00)
python-future 5.38% (2026-06-11 15:58+00:00) (2026-06-11 16:54+00:00)
gdl 3.36% (2026-06-11 13:35+00:00) (2026-06-11 17:32+00:00)
libquvi-scripts 2.31% (2026-06-11 15:05+00:00) (2026-06-11 17:33+00:00)
libquvi 2.22% (2026-06-11 15:04+00:00) (2026-06-11 17:33+00:00)
gtkimageview 2.19% (2026-06-11 13:44+00:00) (2026-06-11 17:33+00:00)
python2-pyparsing 2.02% (2026-06-11 14:23+00:00) (2026-06-11 17:40+00:00)
python2-appdirs 1.96% (2026-06-11 14:22+00:00) (2026-06-11 17:26+00:00)
compiler-rt19 1.95% (2026-06-11 14:23+00:00) (2026-06-11 17:30+00:00)
python2-packaging 1.90% (2026-06-11 14:21+00:00) (2026-06-11 17:38+00:00)
wine-nine 1.86% (2026-06-11 15:48+00:00) (2026-06-11 21:36+00:00)
clang19 1.86% (2026-06-11 15:36+00:00) (2026-06-11 21:24+00:00)
clang15 1.76% (2026-06-12 12:34+00:00) (2026-06-12 12:54+00:00)
mono-addins 1.69% (2026-06-11 15:33+00:00) (2026-06-11 21:34+00:00)
python2-chardet 1.68% (2026-06-12 12:42+00:00) (2026-06-12 14:48+00:00)
python-monotonic 1.55% (2026-06-11 15:43+00:00) (2026-06-11 21:37+00:00)
python2-cffi 1.47% (2026-06-12 12:44+00:00) (2026-06-12 15:10+00:00)
alvr 1.26% (2026-06-11 13:54+00:00) (2026-06-11 16:50+00:00)
python2-gobject 1.23% (2026-06-12 12:44+00:00) (2026-06-12 14:47+00:00)
vidcutter 1.03% (2026-06-11 13:24+00:00) (2026-06-11 17:43+00:00)
Learn more about the attack: https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency.
https://bbs.archlinux.org/viewtopic.php?id=313892
This helped me get an overview yesterday.
I made some comments, pointing out that some distros use the AUR in unintended ways, adding to its popularity but also making it easier for attackers to do shit like this.
Today I was told that this was "politics" between distros and really everybody should be able to use the AUR how they see fit.
That was a bit out there, but many people are hellbent on pushing the "company fucked up with tech security" narrative here.