Skip to main content
AVOID.NET

Atomic Arch AUR Supply Chain Attack

avoid.net/atomic-arch-aur-supply-chain-attack→0/100·91% conf.
[AI-DRAFTED · AWAITING FACT-CHECK]

Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →

anchored·3LnaFE…mJ8N
Submit evidence

Summary

Atomic Arch is a large-scale software supply chain attack disclosed on June 11, 2026, in which threat actors systematically adopted orphaned packages in the Arch User Repository (AUR) and modified their PKGBUILD build scripts to silently install malicious npm packages. The malicious packages deployed a Rust-based credential infostealer and an eBPF kernel rootkit targeting developer secrets, cloud credentials, and cryptocurrency wallet data. Within 24 hours of initial disclosure, the compromised package count escalated from roughly 408 to an estimated 1,500+, making this one of the largest AUR incidents on record.

Connected Entities

2 entities · 52 linked investigations
Organizations
□Atomic Arch AUR Supply Chain Attack□Monero66
Relationships
  • Atomic Arch AUR Supply Chain Attack→mentioned with→Monero(60%)
Also appears in
Cosmos EVM Vulnerability — August 2026 Six-Chain Exploit·18Malone Lam Crypto Syndicate·0Monero·66Nirvana Finance·26eXch·0AudiA6·0Tiffany Milanovich·25Waygu / Wagyu·12requests-secure-v2·0FIFA World Cup 2026 Crypto Streaming Scam Network·0

Connected Through

1 shared actor · 52 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Atomic Arch AUR Supply Chain Attack?
0
Accepted
1
Under review
0
Rejected / revoked

1 submission awaiting moderator review.

Timeline(5 events)

9 June 2026

Earliest suspected installation dates for compromised packages, based on pacman.log forensic windows identified by community researchers.

CSA Lab Space

11 June 2026

Sonatype researchers identify and disclose the Atomic Arch campaign. Initial count of approximately 408 compromised AUR packages. Malicious npm packages atomic-lockfile and js-digest identified. Sonatype advisory Sonatype-2026-003775 issued (CVSS 8.7).

Sonatype

12 June 2026

Second wave of compromised packages identified using Bun-based installation paths alongside npm. Estimated total compromised packages rises to approximately 1,500. Privacy Guides publishes advisory describing the incident as one of the largest AUR attacks on record. Arch Linux temporarily suspends new AUR account registrations. Sonatype-2026-003808 issued for second wave.

Privacy Guides / Sonatype

13 June 2026

Multiple security news outlets publish coverage. WebProNews, CybersecurityNews, Eastern Herald, and others report on the campaign. Community detection tool aur-malware-check published on GitHub by lenucksi.

CybersecurityNews / GitHub

14 June 2026

Cloud Security Alliance (CSA) Lab Space publishes detailed research note on the eBPF rootkit component, including BPF map structure, persistence mechanisms, and network detection guidance.

Cloud Security Alliance
Provenance & Audit Trail
Recorded on Solana ✓Verify on-chain10 Wayback Archives

Decision Log

  • #1publishRecorded on Solana ✓6/15/2026, 11:08:24 PM
    slot 426730977 · hash AD7FLSxJcbPQqvFqainsu82ZUZ8qWg49JP8zLX8QcGtC

This investigation is cryptographically anchored to the Solana blockchain (1 decision). 10 of 10 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-code-investigator

generated: 6/15/2026, 11:08:16 PM

last updated: 6/15/2026, 11:08:16 PM

5 views

avoid.net — verified advice for a post-truth world