[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMiNBDzoH6Uyo4Mq9ijfSdIxC_XDHHuZSHGknCqOdMsI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":18,"created_at":19,"published_at":20,"article":21,"tags":25,"podcasts":38,"controls":45},"631c2a86-f1bd-41ef-806c-0a9687a760ea","supply-chain-attack-through-package-repository-takeover","4ad7597a-4687-41ab-9368-6959d55a4e9d","Supply Chain Attack Through Package Repository Takeover","The Atomic Arch campaign demonstrates how threat actors can exploit package repository governance weaknesses to distribute malware at scale. By taking over abandoned packages in the Arch User Repository (AUR) and modifying build instructions to include malicious dependencies, attackers successfully compromised 20+ packages with rootkit payloads. This attack highlights the critical importance of vetting third-party packages and understanding the trust model of community-maintained repositories. The use of eBPF for stealth and credential theft shows sophisticated techniques that can bypass traditional security controls.","**Immediate actions:**\n- Audit all currently installed AUR packages and verify their maintainers and recent changes\n- Implement package integrity checking and signature verification before installation\n- Review systems for indicators of compromise including unusual network connections and credential access\n\n**Long-term improvements:**\n- Establish approval processes for installing packages from community repositories like AUR\n- Deploy application allowlisting to prevent unauthorized executables from running\n- Implement behavioral monitoring to detect suspicious package installation and execution patterns\n\n**Supply chain security:**\n- Maintain an inventory of all third-party packages and dependencies across the environment\n- Subscribe to security advisories for package repositories and distributions in use\n- Consider using only officially maintained packages or thoroughly vetted alternatives when possible",[12,13,14,15,16],"CIS Control 2","CIS Control 11","NIST SP 800-161","NIST SC-7","NIST SI-7",{},"published","2026-06-12T20:21:20.331968+00:00","2026-06-12T20:21:20.247+00:00",{"id":7,"url":22,"slug":23,"title":24},"https:\u002F\u002Fhackread.com\u002Fatomic-arch-hijacks-linux-aur-packages-malware\u002F","atomic-arch-campaign-hijacks-20-linux-aur-packages-to-deliver-malware-c336a7","Atomic Arch Campaign Hijacks 20+ Linux AUR Packages to Deliver Malware",[26,32],{"id":27,"name":28,"slug":29,"description":30,"color":31},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":33,"name":34,"slug":35,"description":36,"color":37},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[39],{"id":40,"date":41,"edition":42,"title":43,"audio_url":44},"44597e15-df9a-4c40-b160-005330257f11","2026-06-13","afternoon","ThreatNoir Weekend Brief — June 13","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-06-13\u002Fthreatnoir-afternoon-brief-2026-06-13.mp3",[46,50,54],{"slug":47,"name":48,"problem":49},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":51,"name":52,"problem":53},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":55,"name":56,"problem":57},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]