Around 1,500 AUR Packages Compromised with "Rootkit-Like" Malware

General News
1

Researchers at Sonatype uncovered a massive supply chain attack against the Arch User Repository (AUR) to harvest credentials and exfiltrate user data by hijacking around 1,500 packages.

This is a companion discussion topic for the original entry at https://www.privacyguides.org/news/2026/06/12/around-1-500-aur-packages-compromised-with-rootkit-like-malware/
2 Likes
2

Thankfully I was not hit by that, it seems like as with the other supply chain attacks maybe only around 100 people were affected if I’m understanding this right (https://socket.dev/npm/package/atomic-lockfile)

I don’t have NPM installed locally due to this risk but worry sometimes that other packages would pull it in somehow.

Say I was one of those affected and was running opensnitch - would I see something like a popup saying npm install atomic-lockfile ?

1 Like