INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Atomic Arch Campaign Exploits Linux AUR to Deliver Malware

| 2026-06-12 18:17 HIGH LOW
JSON
Executive Summary AI-generated
The Atomic Arch campaign is a sophisticated malware attack that targets Linux systems by exploiting vulnerabilities in the open-source ownership transfer process. This campaign, dubbed "Atomic Arch," hijacks 20+ Linux AUR (Arch User Repository) packages to deliver malicious malware. The attackers use a native Linux binary executable bundled with an atomic-lockfile package, which loads a specific code file named scales.bpf.c to gain rootkit-like powers. The attack has already compromised over 20 AUR packages, making it one of the most significant software supply chain attacks on record.
Technical Mitigations AI-generated
• Regularly update and patch Linux systems to ensure that known vulnerabilities are addressed. • Implement a secure package management system, such as RPM or DEB, which can detect and prevent malicious packages from being installed. • Use a combination of signature-based security tools and behavior-based detection techniques to identify potential threats in the AUR. • Monitor system logs for suspicious activity related to package installations and updates.
Technical Observables
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Campaign HijacksCampaign Hijacks
Target & Sectors
Global Scope technologytechnology
Incident Timeline
‎2026/06/12
The threat actors used a Linux kernel technology called eBPF to deliver malware by exploiting the PKGBUILD configuration file of over 20+ Linux AUR packages.
infrastructure Linux
Triggered during a preinstall script phase inside the package.json file, this binary deploys a second-stage payload using a Linux kernel technology called eBPF.
Atomic Arch Campaign Hijacks 20+ Linux AUR Packages to Deliver Malware.
Research firm Sonatype has discovered a malicious campaign targeting Linux systems in an entirely different way.
Advanced Stealth Techniques Sonatype researcher Adam Reynolds analysed the atomic-lockfile package and found a bundled native Linux binary executable.
organisation Linux systems
Research firm Sonatype has discovered a malicious campaign targeting Linux systems in an entirely different way.
organisation Advanced Stealth Techniques Sonatype
Advanced Stealth Techniques Sonatype researcher Adam Reynolds analysed the atomic-lockfile package and found a bundled native Linux binary executable.
organisation CVSS
Sonatype Research Labs is tracking this specific atomic-lockfile dependency under the reference Sonatype-2026-003775 , giving the threat a high-severity CVSS score of 8.7.
organisation the Arch User Repository
The campaign is dubbed “Atomic Arch” as it targets the Arch User Repository (AUR), an online platform where community members maintain installation files for different software packages.
organisation Hackread.com
Sonatype has shared the technical details of this ongoing software supply chain attack with Hackread.com.
organisation PKGBUILD
They rewrite the build instructions inside a configuration file called the PKGBUILD.
organisation npm
This forces the computer to get a malicious dependency called atomic-lockfile, the primary malware package used in this attack, from the public npm registry.
organisation SSH
It looks for GitHub keys, SSH data, HashiCorp Vault tokens, browser cookies, and saved data from a wide range of communication tools such as Slack, Discord, Microsoft Teams, and Telegram.
organisation HashiCorp
It looks for GitHub keys, SSH data, HashiCorp Vault tokens, browser cookies, and saved data from a wide range of communication tools such as Slack, Discord, Microsoft Teams, and Telegram.
organisation Slack
It looks for GitHub keys, SSH data, HashiCorp Vault tokens, browser cookies, and saved data from a wide range of communication tools such as Slack, Discord, Microsoft Teams, and Telegram.
organisation Discord
It looks for GitHub keys, SSH data, HashiCorp Vault tokens, browser cookies, and saved data from a wide range of communication tools such as Slack, Discord, Microsoft Teams, and Telegram.
organisation Microsoft Teams
It looks for GitHub keys, SSH data, HashiCorp Vault tokens, browser cookies, and saved data from a wide range of communication tools such as Slack, Discord, Microsoft Teams, and Telegram.
organisation Telegram
It looks for GitHub keys, SSH data, HashiCorp Vault tokens, browser cookies, and saved data from a wide range of communication tools such as Slack, Discord, Microsoft Teams, and Telegram.
organisation IronWorm, Sonatype
While these methods look a lot like an older campaign called IronWorm, Sonatype has not officially linked Atomic Arch to a specific hacker group yet.
Tactical Metrics
Metrics
infrastructure
‎Linux
Affected Product
Triggered during a preinstall script phase inside the package.json file, this binary deploys a second-stage payload using a Linux kernel technology called eBPF.
Atomic Arch Campaign Hijacks 20+ Linux AUR Packages to Deliver Malware.
Research firm Sonatype has discovered a malicious campaign targeting Linux systems in an entirely different way.
Advanced Stealth Techniques Sonatype researcher Adam Reynolds analysed the atomic-lockfile package and found a bundled native Linux binary executable.
Intelligence Sources
HackRead 2026-06-12
HackRead 2026-06-12