446 Arch Linux packages hijacked with eBPF rootkit and infostealer
Someone hijacked 446 packages in the Arch User Repository and pushed updates laced with a Rust-based infostealer paired with an eBPF rootkit. This is not a drill.
An attacker created a new AUR maintainer account spoofing a trusted maintainer, adopted over 400 orphaned packages, and injected malicious preinstall scripts. The scripts pulled NPM packages (atomic-lockfile v1.4.2 and js-digest) that executed a 3 MB ELF binary called deps during the build process.
The reverse engineering by Whanos at ioctl.fail (published June 11) reveals the malware is unusually sophisticated. It steals credentials from 30+ Chromium-family browsers, Slack, Microsoft Teams, Discord (including every third-party client variant), GitHub OAuth tokens, npm auth tokens, SSH keys, shell histories, Docker credentials, and VPN profiles. It even queries the OpenAI API with stolen bearer tokens. If you had ChatGPT credentials on an Arch machine, assume they are gone.
The persistence mechanism installs systemd services with Restart=always and RestartSec=30 under /var/lib/ or ~/.config/systemd/user/ depending on privilege level. Single-instance enforcement via flock().
The eBPF rootkit component is what makes this stand out from typical supply chain droppers. When running as root with CAP_BPF or CAP_SYS_ADMIN, it loads BPF programs that hide processes from /proc listings, hide socket inodes from /proc/net/tcp, and kill ptrace attachment attempts against hidden processes. It pins maps at /sys/fs/bpf/hidden_pids, hidden_names, and hidden_inodes. This means standard live-response tools on a compromised host will not see the malware. You cannot trust the output of ps, ss, netstat, or lsof on an infected machine.
Command and control goes through a Tor onion service at olrh4mibs62l6kkuvvjyc5lrercqg5tz543r4lsw3o6mh5qb7g7sneid.onion, XOR-encoded in the binary and decoded at runtime. The malware also contains a downloader that stages a binary as /usr/bin/monero-wallet-gui which is almost certainly a cryptominer.
The delivery chain is straightforward: the AUR package’s PKGBUILD calls npm or bun, npm reads package.json, the preinstall hook executes ./src/hooks/deps, and the Linux ELF malware starts. Two NPM packages served as the delivery vehicle. Both have been pulled from NPM and replaced with security holding packages. The NPM account herbsobering published atomic-lockfile.
Jonathan Grotelüschen (tippfehlr) raised the alarm on the AUR mailing list. Taggart (mttaggart) aggregated the findings on IFIN Discourse at 04:35 UTC on June 12. Phoronix published coverage at 06:39 AM EDT the same day. The IFIN report has been edited 7 times as the scope keeps expanding.
Kidev published a check script listing all 446 affected packages on GitHub. The list includes packages like linux-cachyos-native (a popular CachyOS kernel), exodus-wallet-bin, anythingllm-appimage, bitcoin-core-git, and clang19. The attacker targeted high-value developer tools, cryptocurrency wallets, and system packages.
If you run Arch Linux and installed or updated any AUR package in the past week, check Kidev’s gist immediately. If you find a match, do not bother trying to clean it. The eBPF rootkit can hide from every userspace tool you would use to investigate. Rotate every credential that touched that machine (browsers, Slack, Discord, GitHub, npm, SSH, VPN, Docker) and reinstall the OS from scratch.
The AUR has no mandatory code review for package updates. Any maintainer can push arbitrary PKGBUILD changes to their packages. This is by design - the AUR is a community repository, not a curated distribution channel. The tradeoff between openness and security has been debated for years. This incident is the strongest argument yet that the AUR needs automated diff scanning or at least basic preinstall script auditing before packages go live.
This is one of the largest supply chain attacks against the AUR ever recorded, and the combination of infostealer plus eBPF rootkit makes it significantly more dangerous than the typical crypto miner injection. The attack was designed to target developer workstations specifically, harvesting the credentials that grant access to code repositories, package registries, and cloud infrastructure.