--- title: "Arch Linux AUR hit by malware targeting developer secrets" url: https://daily.dev/posts/arch-linux-aur-hit-by-malware-targeting-developer-secrets-sj2f1gofq source_url: https://thenextweb.com/news/arch-linux-aur-malware-credential-stealer-supply-chain type: article source: "The Next Web" published: 2026-06-16T15:42:20.535Z updated: 2026-06-16T15:42:41.516Z tags: ["cyber", "linux", "malware"] reading_time: 4 upvotes: 3 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Arch Linux AUR hit by malware targeting developer secrets **[The Next Web](https://daily.dev/sources/tnw)** · 4 min read · 3 upvotes · 0 comments ## Summary Attackers hijacked over 1,500 packages in Arch Linux's AUR by adopting orphaned packages and rewriting their build scripts to install a credential stealer. The malware, a Rust binary, harvests browser cookies, session tokens, GitHub/npm tokens, SSH keys, Docker logins, and more, exfiltrating data over Tor. The attack exploited the AUR's trust model rather than any technical vulnerability — spoofed git commit data made changes appear legitimate. An optional eBPF component hides the malware if root access is available. Arch's official repos were unaffected. With ~13,000 orphaned AUR packages remaining, the structural risk persists. Users are advised to read build scripts before compiling and treat recently adopted packages with suspicion. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Over 400 Arch Linux packages compromised to push rootkit, infostealer](https://daily.dev/posts/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer-f7ileezok) · BleepingComputer · 94 upvotes · 7 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#linux](https://daily.dev/tags/linux), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/arch-linux-aur-hit-by-malware-targeting-developer-secrets-sj2f1gofq)