The attackers injected commands into build scripts that pulled malicious dependencies, including rogue npm packages such as atomic-lockfile and js-digest, which executed automatically during the package build process. This approach allowed attackers to distribute malware without modifying the software itself, instead abusing the trusted build pipeline [1].

The payload included[1]:
A Rust-based infostealer designed to collect sensitive data such as:

• Browser cookies and session data
• SSH keys and shell histories
• API tokens (e.g., GitHub, npm, and cloud services)
• Credentials from collaboration tools like Slack, Discord, and Teams
• An eBPF rootkit that can load when executed with elevated privileges, enabling stealth by hiding processes and artifacts at the kernel level

The AUR is Arch Linux’s community package collection, and it is separate from the official Arch repositories, which were not affected.

Affected Products

Arch Linux AUR
A list of affected packages at the time of writing can be found here[2]:
https://md.archlinux.org/s/SxbqukK6IA

The list of affected packages is extensive and evolving. Customers should treat any AUR package installed or updated since June 11, 2026 as potentially compromised.
Exploitation

The campaign began on or around June 11, 2026, and actively compromised hundreds of AUR packages, later expanding to over 1,500 affected packages.
Recommended Actions

• Review all AUR packages installed or updated since June 11, 2026, and compare them against known affected package lists found here: https://md.archlinux.org/s/SxbqukK6IA
• Immediately rotate all credentials (SSH keys, API tokens, passwords) on systems that may have installed affected packages
• Treat systems where malicious packages were executed with elevated privileges as potentially fully compromised and consider reinstallation from trusted media
• Monitor for suspicious activity, including:
  • Unusual outbound connections (e.g., HTTP exfiltration or Tor usage)
  • Unexpected systemd services or persistence mechanisms

Limit reliance on unvetted third-party repositories and implement stricter validation of build scripts before execution.

References

[1] https://thehackernews.com/2026/06/over-400-arch-linux-aur-packages.html
[2] https://md.archlinux.org/s/SxbqukK6IA
[3] https://archlinux.org/news/active-aur-malicious-packages-incident/