More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens.

BleepingComputer

Over 400 packages in the Arch User Repository (AUR) have been compromised to distribute a Linux rootkit and infostealer malware. Attackers spoofed trusted publishers and hijacked orphaned packages, modifying PKGBUILD scripts to install a malicious npm package called atomic-lockfile. This package drops a Linux ELF binary with credential-stealing capabilities targeting GitHub tokens, SSH keys, browser cookies, Slack, Discord, Teams, Telegram data, and more. An optional eBPF rootkit component can hide processes, files, and network interfaces at the kernel level. AUR maintainers are removing malicious commits and banning responsible accounts. Affected users are advised to rotate all credentials and consider a full reinstall, as rootkits may survive standard cleanup.

Over 400 Arch Linux packages compromised to push rootkit, infostealer

<p>That’s terribly disappointing: I was considering Arch for my next PC build, but this probably won’t be a one-off incident. On the other hand, my next PC build could be a decade away given current hardware prices, so hopefully AUR (and other package managers) will have found a way to verify the intent of new package releases by then…</p>
