Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
Over 400 Arch Linux AUR packages compromised to deploy infostealer and eBPF rootkit.
Attackers compromised over 400 packages in the Arch User Repository (AUR) by rewriting their build scripts to install a Rust-based credential stealer. The malware targets developer secrets, including browser data, session tokens, API keys, and SSH keys, exfiltrating them to a Tor onion service. It also includes an optional eBPF rootkit for persistence and stealth when running with root privileges.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Arch User Repository?
Get an email when a new story names Arch User Repository, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers successfully compromised over 400 packages in Arch Linux's AUR by modifying build scripts to include malicious code that steals developer credentials and installs rootkits. This supply chain attack demonstrates how open-source repositories can be weaponized to distribute malware at scale, particularly targeting developers who have access to valuable secrets and infrastructure. The incident highlights the critical need for package verification, secure development practices, and vigilant monitoring of third-party dependencies.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — deps.linux.elf
- malware — eBPF rootkit