Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Over 400 Arch Linux AUR packages were hijacked to deploy a Rust credential stealer with optional eBPF rootkit functionality.

• •Attackers adopted abandoned packages and modified build scripts to execute malicious npm dependencies (atomic-lockfile and js-digest)
• •The malware harvests browser tokens, SSH keys, GitHub/npm credentials, Docker credentials, and shell histories via HTTP exfiltration
• •An eBPF rootkit can hide processes and prevent debugger attachment when executed with root, requiring system reinstallation for cleanup
• •The attack exploited the AUR's trust model by keeping package names and histories while modifying only the build instructions

This summary was automatically generated by AI based on the original article and may not be fully accurate.