Atomic Arch supply-chain attack backdoors roughly 1,500 AUR packages to steal AI tokens

A coordinated supply-chain campaign dubbed Atomic Arch has backdoored a large number of packages in the Arch User Repository (AUR), planting a payload that targets AI API tokens, browser cookies and developer secrets.

The campaign began on June 11, 2026, and Sonatype's technical analysis — which tracks the activity as Sonatype-2026-003775 (CVSS 8.7) — says a second wave the next day pushed the preliminary estimate to roughly 1,500 affected packages. The official Arch Linux repositories were not affected; only AUR community packages, which users build from author-submitted scripts.

The attackers adopted orphaned packages through AUR's standard adoption process, then modified the PKGBUILD to run an "npm install atomic-lockfile" step during the build, pulling a malicious npm package that deployed a bundled native Linux executable. A second wave used a Bun-based installation path and additional malicious packages including js-digest and lockfile-js, according to Sonatype.

Sonatype's analysis of the atomic-lockfile package found a bundled Linux binary tied to credential and token harvesting, referencing GitHub credentials, SSH artifacts, HashiCorp Vault tokens, browser cookie databases, and session data from Slack, Discord, Microsoft Teams and Telegram. Alongside archive support, the binary includes HTTP upload functionality — including references to a POST /upload endpoint — that points to data-exfiltration capability. It also references an eBPF program and libbpf APIs used to hide processes, files and network activity, plus debugger-detection logic, indicating an attempt to reduce visibility and hinder analysis.

Sonatype said the affected-package count may continue to change as maintainers audit their repositories, so the final scope could shift. The Arch maintainers flagged the compromise on the aur-general mailing list, where they said they were working to reset or delete the malicious commits and ban the accounts involved. Anyone who installed an AUR package this week should treat affected hosts as compromised and rotate exposed credentials and API keys.