# Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware

> **Open Intelligence Dossier** · First detected: 2026-06-12 13:07 UTC · Category: Technology

## Executive Summary
Over 400 user-contributed packages on the Arch Linux User Repository have been compromised in a widespread supply chain attack.

## Intelligence Brief
A campaign has targeted the Arch Linux User Repository (AUR), resulting in the compromise of more than 400 packages. The malicious activity involves the deployment of infostealers, a Rust-based credential stealer, and an eBPF rootkit via hijacked package descriptions and dependencies.


Coverage from outlets including Phoronix, The Hacker News, and Sonatype emphasizes that the campaign utilizes an "Atomic Arch" methodology to distribute malicious code. Reports from heise online, GamingOnLinux, and Linuxiac highlight that the threat specifically affects user-contributed content within the repository.


Future developments will focus on the remediation of affected packages and potential security updates for the AUR ecosystem. Details regarding the identities of the attackers or the full extent of impacted user systems are currently unspecified.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| heise online | Attack wave on Arch Linux: hundreds of package descriptions with malware in AUR | [Source Link](https://news.google.com/rss/articles/CBMivgFBVV95cUxPQXV1MzljcjdubE9tREtfemgyZEJheER1YlRqNzNvZjlJMkN1a2dLNEpncGtBcVhkNnVNdDluQmZNQlhRUHRnZnBYaDRTaFgwbzc3Rm5SWTVOWWd3a05MVlF1bFFYNVIzNkZUaWZ6OEpJZ1hiTk9YV0YzSHFBNzRaU1kwVDJERlpTUXd1bDY5SlFPSFBLMkRhYXR5QUtyNzg1SWNycWtibWZZY2NDQ3BlZ0NwcjNLREo2NDdsbUpn?oc=5) |
| The Hacker News | 400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer | [Source Link](https://news.google.com/rss/articles/CBMihAFBVV95cUxQb3l3eWhPY3AxdW16OVBQSVNWMnJYa3hJSTlmbHB2aC1kdjY2UExpX0psRGhiOTdSQWVsME1JWWhySlhGQWZKb09SdVlLU1g3SzR6akt6NlBuSmpCbkt2bDJLVXo3eFI3ZUNMQ1dKSmRoeEdzaWtyY3M3MVFMcUdrZE01OEM?oc=5) |
| The Hacker News | Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit | [Source Link](https://news.google.com/rss/articles/CBMie0FVX3lxTE5TalNWTGdGNU5yT0FfR2p3amZWd2NCaUxQNVpwXzNWUmg0YlN4MGJ5MGQ4WC1pTHlPd0hFbG9Bb2NaSXdjQ2xVNTRrNjVVbTFGSHhpbHIzNVlYY25kZlhiSDBkMUJpN1ZmOVlqQ18zb3ctX3g4RHVrdTZFZw?oc=5) |
| CyberSecurityNews | 400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers | [Source Link](https://news.google.com/rss/articles/CBMidEFVX3lxTE9ZSU9obkhvQTRpaTZRTGZrN1ZhQV9JWUJRR1BlbHVsU0E3MmxSWl9OQjdNak1fNWxwR1ZSazNzd0J0SmZyMnlyTmlpUUd5Nm9WOEVxd1NLWHpfVnlIZXdqczVsV1Bqb0xoeDNOTjVHTnR5c3FE0gF6QVVfeXFMTTZUclJCNnJFcXpONDYyMzF0bDA1WVFRZ0s0dS1NTkJzNnJKUTVtY2pNbERHUVhDS211Y2lWOTZLX05aRkRsZDFYb0MwQnZfR0pETExibkJ4b3ZRa2kyRjFIdFREZklmRGE1Nmhhald2MGdDbGR0bHpORnc?oc=5) |
| GamingOnLinux | The Arch Linux AUR had over 400 packages compromised with malware | [Source Link](https://news.google.com/rss/articles/CBMipwFBVV95cUxOSTBtZWNBT2ZQNVRGVWlPLUhHcGlTVEZSdlR3bUQ4YjJKYl8zR2VIcC1ySUUwUmRWTEswWnRXT2ZmdllJQXIxTzFFRWY0OGNYZUpyb1E2RHI3bzBqUzZTd2ZRRTNzUXJjYU9KN3pta2tjQnRRVzBUTlZUQmNLdEpLOWVGNWxraHVnN0JFUVlqTHA3MFNoTGVtbDFXNEpOUHJKOVlWOXl4QQ?oc=5) |
| Security Boulevard | Atomic Arch npm Campaign Adds Malicious Dependency | [Source Link](https://news.google.com/rss/articles/CBMikwFBVV95cUxQamRFYXdwSG9SYm1VNjhHUUFrUzVQUWI4Z2ZleXA5RzRKMzR0M1lVZEFTaTB6UjQ4QnYyWkx3UUdzVHhkTFJvU1RKYzRMSTJyZnB1dFdHbDhZNFVNNnd4ajBjOG9KYWNuQUNPbFJEckoycEd5a3ZwWVNTNm1HUFBiLWhVM3QxNl9YTDBfZkUyN05NNWM?oc=5) |
| Linuxiac | Arch Linux AUR Malware Campaign Hits Multiple User-Contributed Packages | [Source Link](https://news.google.com/rss/articles/CBMimAFBVV95cUxPbWRqSHRLdkRFNjFiTkZZc1ZhbWxaRDJCeGJudHpKQkdBbUFfZVhBYUd2NzhkbjdTM0djaldvckRTcVhlWHpYejBwMjRqVVpSd2JUU2FOTVJPVDFnOW1GTFRmQ0t3NWxOSlVhVUthMmZuQXJhRmswQjlwaHdGYXM3M2FicHZFZ1NWSnBJQ0ZYVWJvQ2JEekN1Mw?oc=5) |
| Sonatype | Atomic Arch: Attackers Hijack Trusted AUR Packages to Deliver Rootkit-Like Malware | [Source Link](https://news.google.com/rss/articles/CBMihwFBVV95cUxQUERHaXpreE1qN256QTJXdERYcTBuT0ZkV0sxUVVoREFJOXkyOFZJUU10UkliWVFBaGNmeVpSUTlVXzNoZVpQd0RiRW1IektUS1Y1RjFVeDlHdHN5RHQxRmY4Z0hhV2FEaXVxZFR3cWtIeG9saVNLVG96MTEwZ0R6ZUtYTnViT3PSAZcBQVVfeXFMUGVrcllsZnF6ZVdPYmNkTjI3S1A2amRqNFpydUZOYTZJMmk0aElWNi14R0ZrcEh2YXdZaWNuVWRXdEU1SnMtZnVhV1VRbTE3S05tT0FHdUlULVlXLUN4Rk1YcGlzZGIybFpxOGhORmFXSndPTGN4cjdTaG1jNldQU05NOUxzaTFIb1JUZXoxa2NKQko4a3Qtaw?oc=5) |
| Phoronix | Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware | [Source Link](https://news.google.com/rss/articles/CBMibEFVX3lxTE44em1yMlpuTDEtTnJ1NkgwUU5uTlJWZXk2QXQ4d1pyTzNnSVR2emswWDhzeG9oMGRIaTF6YV9hT3lIT08zWnhzbnVCWXpvNHU1TXRNM0JSYVFuWWRHMEtadVhkUXhuRXJGNElNdg?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-06-12/arch-linux-s-aur-sees-more-than-400-packages-compromised-with-malware*