[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1iC-LCvgsIJcEThpR0D8ygcD6f3PiXyaxZ6xEHSyQLY":3},{"article":4,"iocs":50,"watch_terms":54,"solutions":55,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"c3fe79f0-a754-4c45-b111-40104a8d6164","Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages","atomic-arch-supply-chain-attack-hits-1-500-aur-packages-b91ed3","Arch Linux suspended account registrations in response to the wave of malicious packages being uploaded to AUR. The post Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages appeared first on SecurityWeek.","Arch Linux has suspended new account registrations for its User Repository (AUR) following a supply chain attack named Atomic Arch. Attackers modified abandoned AUR packages to execute malicious code during installation, initially targeting NPM packages and later shifting to Bun-based installations. The campaign has led to over 1,500 malicious packages being published, with the malware designed for credential and secret harvesting.","Arch Linux suspends AUR account registrations due to a supply chain attack impacting over 1,500 packages.","https:\u002F\u002Fwww.securityweek.com\u002Fatomic-arch-supply-chain-attack-hits-1500-aur-packages\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fsupply-chain-threat.webp","2026-06-16T10:51:49+00:00","2026-06-16T12:00:07.03283+00:00",8,[17,20,23,25],{"name":18,"type":19},"AUR","product",{"name":21,"type":22},"NPM","technology",{"name":24,"type":22},"Bun",{"name":26,"type":22},"eBPF","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":27,"icon":29,"name":30,"slug":31},null,"Supply Chain","supply-chain",[33,35,40,45],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":39,"value":52,"context":53},"atomic-lockfile","Malicious NPM package name used in the attack.",[18],{"controls":56,"vendors":139},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":116,"name":117,"problem":118,"products":119},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[120,128,133],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":129,"product_name":130,"url":131,"description":132},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":134,"product_name":135,"url":137,"description":138},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[140],{"slug":141,"name":142,"logo_path":143,"roles":144},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png",[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":160},"atomic-arch-1500-aur-packages-compromised-in-supply-chain-attack","Atomic Arch: 1,500 AUR Packages Compromised in Supply Chain Attack","Attackers exploited abandoned and unmaintained packages in the Arch Linux User Repository (AUR) to inject malicious code that executes during installation, targeting both NPM and Bun-based ecosystems. The root cause lies in inadequate oversight of community-maintained package repositories, where orphaned packages create an easy entry point for adversaries. Over 1,500 malicious packages were published as part of this campaign, designed to harvest credentials and secrets from affected systems. This attack highlights the systemic risk of trusting open, community-driven repositories without rigorous vetting, and underscores how attackers increasingly abuse the software supply chain to compromise developer and end-user environments at scale.",[151,152,153,154,155,156,157,158,159],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161r1: Cyber Supply Chain Risk Management","NIST SP 800-218 (SSDF): Secure Software Development Framework","NIST CSF ID.SC-4: Suppliers are routinely assessed","NIST AC-6: Least Privilege","SLSA Supply Chain Levels for Software Artifacts (Levels 2-3)","OWASP A06:2021 – Vulnerable and Outdated Components","GDPR Article 32: Security of Processing (if PII credentials were exposed)",{}]