--- title: "lists.archlinux.org" url: https://daily.dev/posts/lists-archlinux-org-vtya7bvfc source_url: https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4 type: article source: "Lobsters" published: 2026-06-11T22:01:56.126Z updated: 2026-06-11T22:02:19.494Z tags: ["cyber", "linux", "npm"] reading_time: 15 upvotes: 12 comments: 1 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # lists.archlinux.org **[Lobsters](https://daily.dev/sources/lobsters)** · 15 min read · 12 upvotes · 1 comments ## Summary A coordinated supply chain attack was discovered in the Arch User Repository (AUR), where approximately 408 packages had malicious commits injecting `npm install atomic-lockfile` commands into their PKGBUILDs or related install/hook scripts. A community member identified the full list of affected packages by scanning the AUR's GitHub mirror. The AUR team is actively resetting/deleting the malicious commits and banning the responsible accounts, while contributors are asked to report additional affected packages in a single email thread. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@rickvian** · 4 upvotes > days since another supply chain attack in npm: 0 ## Similar posts on daily.dev - [Hundreds of AUR packages compromised](https://daily.dev/posts/hundreds-of-aur-packages-compromised-qfoj9ykq1) · LWN.net · 0 upvotes · 0 comments - [Over 400 Arch Linux packages compromised to push rootkit, infostealer](https://daily.dev/posts/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer-f7ileezok) · BleepingComputer · 94 upvotes · 7 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#linux](https://daily.dev/tags/linux), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/lists-archlinux-org-vtya7bvfc)