More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware that targets credentials and access tokens.
A report from the open-source intelligence community Independent Federated Intelligence Network (IFIN) indicates that a new maintainer is impersonating a trusted publisher on the AUR platform in order to push infected packages.
The Arch Linux distribution is favored by power users and developers, relying on the AUR catalog to deliver the latest versions of installed software, drivers, and the kernel.
AUR is a community-maintained repository for the Arch distribution that contains package build scripts (PKGBUILDs) with instructions for downloading, compiling, and installing software that is not available in Arch’s official repositories.
AUR is regarded as essential for any Arch-based distribution because it includes proprietary applications, beta/nightly versions of open-source software, niche utilities, and older versions of packages that preserve functionality that may have been eliminated in later releases.
However, it is not a vetted space, and threat actors can exploit it to distribute malware through packages that change ownership without detection.
According to IFIN member Michael Taggart, the compromised packages are altered with preinstall scripts that download and execute a malicious npm package named atomic-lockfile.
Independent security researcher Whanos notes that one sample of atomic-lockfile contained a Linux ELF payload called deps, which was a "credential stealer with optional root-only eBPF [extended Berkeley Packet Filter] rootkit capabilities."
"It is designed for developer workstations and build environments. It targets browser and Electron application data, Slack, Microsoft Teams, Discord, GitHub, npm, Vault, Docker/Podman, SSH, VPN material, shell histories, and other local developer secrets," Whanos states in the report.
With eBPF technology present, the malware can operate within the kernel with elevated privileges and conceal local processes.
Supply-chain management firm Sonatype also released a report on a campaign targeting the AUR repository and delivering the malicious atomic-lockfile npm package, but employing a different method.
Sonatype researchers report that the threat actor hijacked at least 20 orphaned packages on AUR and distributed atomic-lockfile by altering the PKGBUILD file—a Bash script containing the build information required by Arch Linux packages.
According to the report, the attacker added a post-install script to invoke npm and retrieve the malicious package.
"The modified packages add a post-install script that invokes npm and installs atomic-lockfile during package installation," Sonatype states.
However, analysis revealed that the npm package installed a Linux executable with references to an eBPF rootkit capable of hiding processes, files, and network interfaces.
Additionally, the Linux binary indicates it has infostealer functionality, targeting the following types of sensitive information:
GitHub credentials
SSH artifacts
HashiCorp Vault tokens
Browser cookie databases
Slack data
Discord data
Microsoft Teams data
Telegram data
Sonatype determined that the binary can archive data, handle multi-part files, and perform HTTP uploads, so the functionality for a typical exfiltration mechanism is present.
AUR maintainers are working to identify and remove all malicious commits, and to ban the accounts pushing them.
In a message to the community, Arch Linux package maintainer Jonathan Grotelüschen urged users to report any malicious package they discover.
As a general rule, it is recommended to only trust projects with frequent updates and an active community around them.
Arch users are advised to review the list of affected packages and look for the indicators of compromise provided in the report from Whanos.
Michael Taggart also highlighted a script that checks for the atomic-lockfile malware on the system.
If compromised packages are found, users should rotate all credentials and consider reinstalling Arch from scratch, since a rootkit may survive normal cleaning efforts.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Related Articles:
Shai Hulud attack ships signed malicious TanStack, Mistral npm packages
Popular node-ipc npm package compromised to steal credentials
PyPI package with 1.1M monthly downloads hacked to push infostealer
New npm supply-chain attack self-spreads to steal auth tokens
New Shai-Hulud attack trojanizes 19 science-focused PyPI packages