Orphaned AUR packages adopted and rewritten to steal credentials

Sonatype researchers disclosed on June 11, 2026 that attackers had begun taking over abandoned packages in the Arch User Repository and rewriting their build scripts to install a credential stealer. They named the campaign Atomic Arch. Sonatype counted more than 20 hijacked packages that day. Community trackers passed 400 within a day, and later estimates for the combined waves reached roughly 1,500.

The AUR carries user-contributed build recipes rather than binaries, and it is where Arch users get software that is not in the official repositories. Each package is a PKGBUILD shell script that helpers like yay and paru run on the installing machine. When a maintainer walks away, the package is marked orphaned and any AUR account can adopt it through the site's normal process. That is what the attackers used. No credential theft, no forged commits, no compromised infrastructure. They requested packages that already had years of accumulated trust, and the AUR handed them over.

The PKGBUILD edits were small enough to pass a glance. Most add two lines and nothing else: an install= pointing at a new <package>-deps.install scriptlet, and a JavaScript runtime added to depends so the scriptlet is guaranteed something to run. The payload sits in the scriptlet, whose post_install() runs npm install atomic-lockfile minimist chalk or bun add against the attacker's packages. The timing is the point: a pacman install scriptlet runs as root when the package is installed, not as the building user during makepkg, so the credential stealer starts with root on any machine that installs the package. A minority of the hijacked PKGBUILD files invoke the installer during the build instead. A second wave on June 12 swapped in js-digest and lockfile-js, the latter delivered through Bun. Sonatype tracked atomic-lockfile as Sonatype-2026-003775 at CVSS 8.7 and the second-wave packages as Sonatype-2026-003808.

The bundled Linux executable was written in Rust. It collected GitHub credentials, SSH keys, HashiCorp Vault tokens, browser cookies, and session material for Slack, Discord, Teams, and Telegram, checked for PTRACE to frustrate debugging, and where it ran with root it installed an eBPF rootkit that hid its processes, files, and network connections at the kernel level. Truesec advised that any AUR package installed or updated after June 11 be treated as suspect, that credentials be rotated, and that machines which built an affected package with elevated privileges be reinstalled rather than cleaned. AUR maintainers reverted the malicious commits, banned the accounts involved, and published a checklist of affected packages. Arch's official core, extra, and multilib repositories were untouched.