Atomic Arch hijacks AUR packages to drop eBPF rootkit via malicious npm dependency
Researchers found the Atomic Arch campaign hijacking abandoned Arch User Repository packages. By swapping PKGBUILDs to pull in the malicious npm module atomic-lockfile, attackers install a Linux payload with eBPF-based rootkit capabilities, potentially affecting up to 1,500 downstream packages. The move shows how supply-chain trust can be subverted without writing new code.