Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Summary: Attackers took over more than 400 packages in the Arch User Repository this week, rewriting their build scripts so that building them runs npm install atomic-lockfile, whose preinstall hook executes a bundled Rust binary named deps that steals developer credentials. The compromised packages kept their names and histories, with attackers adopting orphaned projects and spoofing git commit metadata to resemble a long-standing maintainer, and a second wave used bun install js-digest from separate accounts.
Key Takeaway: Removing the AUR package is not enough once the payload has run: with root, the binary can load an optional eBPF rootkit that hides its processes and socket inodes from standard tools, so a package manager cannot prove the host is clean. The affected-package list is still incomplete and growing, and no CVE has been assigned.

Read the original at The Hacker News ↗

Topics: Malware
Related: ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026
Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026