Heads up #ArchLinux users!
The "Atomic Arch" supply chain attack (June 9-12) compromised 400-1,500+ AUR packages with an infostealer & eBPF rootkit targeting credentials, browser data, and CI/CD secrets.
Attackers quietly adopted orphaned AUR packages and slipped in malicious PKGBUILDs. The community is actively cleaning up, but now's the time to act.
See also: https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/
muesli
npub1hn…pd29u
2026-06-13 12:04:46 UTC
Author Public Key
npub1hnh4r5r7mc3guavmggj40c990hjr9wwvzv75rnu29pu8jhvuym0slpd29uSeen on
wss://relay.momostr.pinkPublished at
2026-06-13 12:04:46 UTCEvent JSON
{
"id": "3ac3aac86468dfa5e115b3d4100abe1d382d7aa997ae94081b0e93b93ae33516",
"pubkey": "bcef51d07ede228e759b422557e0a57de432b9cc133d41cf8a2878795d9c26df",
"created_at": 1781352286,
"kind": 1,
"tags": [
[
"t",
"archlinux"
],
[
"proxy",
"https://mastodon.social/@fribbledom/116742703431986690",
"web"
],
[
"proxy",
"https://mastodon.social/users/fribbledom/statuses/116742703431986690",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mastodon.social/users/fribbledom/statuses/116742703431986690",
"pink.momostr"
],
[
"-"
]
],
"content": "Heads up #ArchLinux users!\n\nThe \"Atomic Arch\" supply chain attack (June 9-12) compromised 400-1,500+ AUR packages with an infostealer \u0026 eBPF rootkit targeting credentials, browser data, and CI/CD secrets.\n\nAttackers quietly adopted orphaned AUR packages and slipped in malicious PKGBUILDs. The community is actively cleaning up, but now's the time to act.\n\nSee also: https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/",
"sig": "67dd22dd3967a6cebda6f88ce16546b5c7c6a30b08fcd00c90d9acfb6c59e9beff2951ceb42b0d2f3fa5411561fffb8bd75025c3baa7bce3941a861bc3aaf6b0"
}