Arch Linux AUR supply chain attack 2026: In late May and early June 2026, the Arch User Repository (AUR)—the community-maintained build-script layer used by EndeavourOS, Manjaro helpers, and many Arch power users—was hit by a coordinated campaign dubbed Atomic Arch. Attackers adopted orphaned AUR packages, modified PKGBUILD files and .install hooks, and added npm install atomic-lockfile (often alongside decoy modules like chalk, axios, or lodash). Community trackers cite 400+ malicious commits; BreachHistory indexes 353 AUR package names parsed from the central aur-general report thread, plus the npm payload [email protected].
Important: This affects the AUR only—not Arch Linux’s official core/extra/community repositories signed by project packagers.
What is the AUR—and why this attack works
The AUR is a collection of user-submitted PKGBUILD recipes. When you install an AUR package with yay, paru, or makepkg, you execute maintainer shell on your machine—often as root during pacman install hooks. There is no central Arch security review board for every commit. Trust comes from maintainer reputation, git history, and community scrutiny—exactly what attackers exploited by taking over abandoned packages that still have install counts and familiar names.
Atomic Arch attack pattern
Sonatype documented the campaign as Atomic Arch (Sonatype-2026-003775, CVSS 8.7). The typical chain:
- Attacker requests ownership of an orphaned AUR package.
- They add or modify a
*-deps.installpost-install script. - The script runs
npm install atomic-lockfile(sometimes with unrelated npm names as camouflage). - The npm package’s preinstall script executes a bundled native Linux binary—described as rootkit-like with credential harvesting, anti-debugging, and eBPF-related references in analysis.
Because the malicious logic lives in the install hook and a downstream npm dependency, the PKGBUILD can look superficially normal—similar to the 2026 plain-crypto-js axios chain on npm.
Timeline
- Late May 2026 — Earliest aur-general references to suspicious npm hooks (mailing list).
- May 30 – June 11 — Wave of commits adding
atomic-lockfile; maintainers also report forged maintainer emails in metadata. - June 10, 2026 — Malicious npm package
[email protected]published (per npm registry metadata). - June 11, 2026 — Arch contributors open the consolidated AUR REPORT THREAD; cleanup and account bans underway.
- June 12, 2026 — npm security placeholder release; community counts exceed 400 packages in discussion.
Known examples and red flags
Researchers and Arch users flagged packages such as alvr, runescape-launcher, oracle-bin, gnome-randr-rust, and python-starsessions—software that does not normally pull random npm modules during install. Red flags cited across forums:
- New
npmdependency in a non-JavaScript package - Post-install scripts invoking
npm install atomic-lockfile - Maintainer email changed without a credible upstream handoff
- Fresh npm package with no legitimate GitHub repo (noted for
atomic-lockfile)
What the payload does
Sonatype analysis of atomic-lockfile found a bundled native executable run at npm install time, with behavior tied to credential access, stealth, and anti-analysis—hosts that ran affected AUR installs should be treated as potentially compromised, not merely “uninstalled.” Secondary-stage persistence may survive removing the AUR package alone.
Who is at risk
Any Arch-derived system where an affected AUR package was built or updated during the campaign window—especially unattended AUR helpers that auto-sync without diff review. Developers, homelab admins, and CI builders running makepkg as root are high-impact targets because install hooks run with elevated privilege.
Action checklist for Arch / AUR users
- Pause blind AUR updates until your installed set is audited against the BreachHistory package manifest (login for full list).
- Review git diffs for every pending AUR update—search for
npm install,atomic-lockfile, and new.installfiles. - Check install history for packages updated since late May 2026.
- If compromised: isolate the host, rotate SSH keys/passwords/API tokens, review
~/.npm, browser profiles, and crypto wallets on that system. - Prefer pinned AUR commits or local forks for critical packages; do not track live git HEAD on orphaned software.
- Enable supply-chain alerts on BreachHistory if you monitor npm/AUR-adjacent stacks.
Official Arch repos vs AUR
Linuxiac and Arch contributors emphasize: official Arch repositories were not compromised. Enterprise policies should distinguish AUR from signed core packages—and many security teams already ban AUR on production servers for this structural reason.
FAQ
Were official Arch Linux packages affected?
No. The incident is limited to user-contributed AUR packages.
How many AUR packages were hit?
Community reports cite 400+ malicious commits; BreachHistory lists 353 verified package names from the central mailing-list thread (count may grow as cleanup continues).
Is yay/paru itself malware?
No—the helpers are not the root cause; they faithfully build what the AUR git history contains. The failure mode is trusting unreviewed maintainer changes.
What npm package should I block?
atomic-lockfile (malicious versions including 1.4.2 published June 10, 2026). Block at registry/firewall if you operate an npm mirror.
BreachHistory supply-chain record
Full searchable artifact list (353 AUR packages + npm payload):
pkg-aur-atomic-arch-202606 on BreachHistory
Sources: Arch aur-general AUR REPORT THREAD, Sonatype — Atomic Arch, Linuxiac, EndeavourOS forum