Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware
Over 400 user-contributed packages on the Arch Linux User Repository have been compromised in a widespread supply chain attack.
Velocity
How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →
The brief
A campaign has targeted the Arch Linux User Repository (AUR), resulting in the compromise of more than 400 packages. The malicious activity involves the deployment of infostealers, a Rust-based credential stealer, and an eBPF rootkit via hijacked package descriptions and dependencies.
Coverage from outlets including Phoronix, The Hacker News, and Sonatype emphasizes that the campaign utilizes an "Atomic Arch" methodology to distribute malicious code. Reports from heise online, GamingOnLinux, and Linuxiac highlight that the threat specifically affects user-contributed content within the repository.
Future developments will focus on the remediation of affected packages and potential security updates for the AUR ecosystem. Details regarding the identities of the attackers or the full extent of impacted user systems are currently unspecified.
Synthesized by PULSE from the headlines below under a strict no-invention contract. ✓ fact-checked: all claims supported by sources Updated 144d ago.
Quick answers
How many packages were affected?
Coverage indicates that more than 400 packages within the Arch Linux User Repository were compromised.
What types of malware are involved?
Reported threats include infostealers, a Rust credential stealer, and an eBPF rootkit.
What is the name of this campaign?
The campaign has been referred to by sources such as Security Boulevard and Sonatype as "Atomic Arch."
Coverage (9)
- Attack wave on Arch Linux: hundreds of package descriptions with malware in AUR heise online · 145d ago
- 400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer The Hacker News · 145d ago
- Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit The Hacker News · 145d ago
- 400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers CyberSecurityNews · 145d ago
- The Arch Linux AUR had over 400 packages compromised with malware GamingOnLinux · 145d ago
- Atomic Arch npm Campaign Adds Malicious Dependency Security Boulevard · 145d ago
- Arch Linux AUR Malware Campaign Hits Multiple User-Contributed Packages Linuxiac · 145d ago
- Atomic Arch: Attackers Hijack Trusted AUR Packages to Deliver Rootkit-Like Malware Sonatype · 145d ago
- Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware Phoronix · 145d ago
Topics
Related trends
The Security Companies Trying to Get AI Agents Under Control
Security firms and tech leaders are racing to implement governance and isolation frameworks as AI agents gain the ability to act autonomously.
European supermarket fridges got hacked. Again. Here’s what to know
A cybersecurity chief warns that hackers are already targeting supermarket freezers across the United Kingdom, raising alarms over food supply stability.
Fake nuclear warning from hacked app sparks unease but not panic in Ukraine
A hacking incident in Kyiv involving fake nuclear apocalypse alerts has highlighted the resilience and desensitization of the Ukrainian public.
CrowdStrike launches AI kill switch that it says can stop internal agents that go rogue
CrowdStrike introduces a specialized kill switch designed to neutralize rogue internal AI agents alongside significant new acquisitions.
Hackers behind $6.3bn Binance heist ‘used malware and bogus job interviews’
Hackers utilized bogus job interviews and malicious Homebrew downloads to execute a record-breaking $6.3 billion crypto heist.
UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
A critical UEFI bootkit known as BlackX is bypassing Secure Boot on fully updated Windows machines, potentially impacting most servers worldwide.