[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA6Jwa3yGWWUh1L4Eu0TjQ-572jA9R5ilrE0iRHR6pRY":3},{"article":4,"iocs":54,"watch_terms":68,"solutions":69,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"4ad7597a-4687-41ab-9368-6959d55a4e9d","Atomic Arch Campaign Hijacks 20+ Linux AUR Packages to Deliver Malware","atomic-arch-campaign-hijacks-20-linux-aur-packages-to-deliver-malware-c336a7","Over 20 Linux packages were compromised in the Atomic Arch campaign, which abuses AUR ownership transfers to drop rootkit-like malware.","The Atomic Arch campaign is exploiting the Arch User Repository (AUR) ownership transfer process to distribute malware. Threat actors are taking over abandoned packages, rewriting build instructions to include malicious dependencies like 'atomic-lockfile', which then deploys a rootkit-like payload using eBPF. This payload hides its presence and steals sensitive data including credentials, GitHub keys, and tokens.","Atomic Arch campaign hijacks 20+ Linux AUR packages to deliver malware via ownership transfers.","https:\u002F\u002Fhackread.com\u002Fatomic-arch-hijacks-linux-aur-packages-malware\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fatomic-arch-hijacks-linux-aur-packages-malware.jpg","2026-06-12T18:17:16+00:00","2026-06-12T20:00:28.461023+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"Atomic Arch","campaign",{"name":21,"type":22},"AUR","technology",{"name":24,"type":22},"eBPF",{"name":26,"type":27},"atomic-lockfile","product",{"name":29,"type":30},"Sonatype","vendor","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,57,61,65],{"type":43,"value":26,"context":56},"Primary malware package used in the Atomic Arch campaign.",{"type":58,"value":59,"context":60},"url","https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002Fatomic-lockfile","Public npm registry where the malicious dependency is hosted.",{"type":62,"value":63,"context":64},"mitre_attack","T1070.004","Indicator of compromise related to hiding files and processes.",{"type":62,"value":66,"context":67},"T1555","Indicator of compromise related to credential access.",[29,26],{"controls":70,"vendors":157},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":101,"name":102,"problem":103,"products":104},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":130,"name":131,"problem":132,"products":133},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[134,141,149],{"vendor_slug":135,"vendor_name":29,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[158],{"slug":135,"name":29,"logo_path":136,"roles":159},[160],"reported_by",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":171},"supply-chain-attack-through-package-repository-takeover","Supply Chain Attack Through Package Repository Takeover","The Atomic Arch campaign demonstrates how threat actors can exploit package repository governance weaknesses to distribute malware at scale. By taking over abandoned packages in the Arch User Repository (AUR) and modifying build instructions to include malicious dependencies, attackers successfully compromised 20+ packages with rootkit payloads. This attack highlights the critical importance of vetting third-party packages and understanding the trust model of community-maintained repositories. The use of eBPF for stealth and credential theft shows sophisticated techniques that can bypass traditional security controls.",[166,167,168,169,170],"CIS Control 2","CIS Control 11","NIST SP 800-161","NIST SC-7","NIST SI-7",{}]