[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFyFTyiZRqF89FA0Pg-nM6PKP1cSc2UFSRvYCZhcCBeI":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"64f7c554-00ce-4573-aab0-2d32331a3a27","Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit","over-400-arch-linux-aur-packages-hijacked-to-deploy-infostealer-and-ebpf-rootkit-856c09","Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself. The AUR is Arch Linux's community package collection, and it is separate","Attackers compromised over 400 packages in the Arch User Repository (AUR) by rewriting their build scripts to install a Rust-based credential stealer. The malware targets developer secrets, including browser data, session tokens, API keys, and SSH keys, exfiltrating them to a Tor onion service. It also includes an optional eBPF rootkit for persistence and stealth when running with root privileges.","Over 400 Arch Linux AUR packages compromised to deploy infostealer and eBPF rootkit.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fover-400-arch-linux-aur-packages.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjoaB3XILLCN-oMr8vicgye6mcqKGYsgqgxPAGunmwASyrP3c7XgAxJTV8tsVPuRSmJ8ia7SZdS8hyphenhyphenb6moPI2QiwkdKoI2E_zchlBfqx1KnfFpb3yKHQQY6qCWyKmkSK_12texqsHTxtYnv8kMMpzJ-SEFxR7Ougz0axLPVr5zDAWQiZY8pEtUUL8L4hmri\u002Fs1600\u002Farch-hack.jpg","2026-06-12T19:33:25+00:00","2026-06-12T22:00:24.398095+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Arch User Repository","product",{"name":21,"type":19},"alvr",{"name":23,"type":19},"premake-git",{"name":25,"type":19},"atomic-lockfile",{"name":27,"type":19},"monero-wallet-gui",{"name":29,"type":30},"Atomic Arch","campaign","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53],{"type":43,"value":51,"context":52},"deps.linux.elf","Name of the infostealer payload",{"type":43,"value":54,"context":55},"eBPF rootkit","Stealth and persistence mechanism",[18,21,23],{"controls":58,"vendors":144},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":118,"name":119,"problem":120,"products":121},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[122,130,136],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":131,"product_name":132,"url":134,"description":135},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[145],{"slug":137,"name":138,"logo_path":139,"roles":146},[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":158},"package-repository-compromise-highlights-supply-chain-risks","Package Repository Compromise Highlights Supply Chain Risks","Attackers successfully compromised over 400 packages in Arch Linux's AUR by modifying build scripts to include malicious code that steals developer credentials and installs rootkits. This supply chain attack demonstrates how open-source repositories can be weaponized to distribute malware at scale, particularly targeting developers who have access to valuable secrets and infrastructure. The incident highlights the critical need for package verification, secure development practices, and vigilant monitoring of third-party dependencies.",[153,154,155,156,157],"CIS Control 2","CIS Control 7","NIST SP 800-161","NIST CSF PR.DS-6","SLSA Framework",{}]