Between June 9 and June 17, 2026, attackers abused more than 1,900 orphaned Arch User Repository packages to deliver a fake npm payload called atomic-lockfile that stole developer credentials and could escalate into an eBPF rootkit. The campaign also included bun-based variants, Tor-backed exfiltration, and impersonation of legitimate maintainer identities such as arojas and the herbsobering npm account. #atomic-lockfile #js-digest #nextfile-js #AUR #herbsobering #arojas
Keypoints
- The Arch official repositories used by pacman were not compromised; the attack targeted the Arch User Repository (AUR).
- Attackers adopted more than 1,900 orphaned AUR packages and modified install logic to fetch a malicious payload.
- The first-stage payload was the fake npm package atomic-lockfile, which stole SSH keys, CI/CD tokens, chat sessions, browser credentials, and other secrets.
- The campaign evolved across three waves: npm install atomic-lockfile minimist chalk, bun install js-digest, and obfuscated Bun commands using nextfile-js.
- The payload included persistence via systemd services and could hide activity with an eBPF rootkit that hooked getdents64().
- Exfiltration used POST /api/agent to a Tor .onion C2 and a fallback POST /upload to temp.sh.
- Legitimate maintainer identity arojas was impersonated, and a fresh npm account herbsobering was used to publish the lure package.
MITRE Techniques
- [T1195 ] Supply Chain Compromise – Malicious code was inserted by adopting orphaned AUR packages and changing PKGBUILD, hook, or .install logic to fetch the payload (‘the attacker then adopted those packages and modified the PKGBUILD, hook, or .install logic’).
- [T1059.004 ] Unix Shell – Install and execution strings were delivered through package-manager command lines and hooks (‘npm install atomic-lockfile minimist chalk’, ‘bun install js-digest’, and obfuscated Bun command strings).
- [T1055 ] Process Injection – The payload used runtime techniques to conceal and control execution at a low level through a compiled binary and kernel-facing behavior (‘Rust-compiled, async runtime’ and kernel-level concealment).
- [T1543.002 ] Create or Modify System Process: Systemd Service – The binary installed a persistent systemd unit with automatic restart (‘It deploys a systemd service unit … Restart=always and RestartSec=30’).
- [T1041 ] Exfiltration Over C2 Channel – Stolen data was sent to a Tor C2 using HTTP POST requests (‘Primary: a POST /api/agent to the Tor C2’).
- [T1105 ] Ingress Tool Transfer – The attacker caused package managers to retrieve malicious payloads during installation (‘force npm or bun to fetch the malicious atomic-lockfile package’).
- [T1027 ] Obfuscated Files or Information – The onion address was XOR-encoded and later decoded at runtime (’62-byte XOR-encoded blob … decoded at runtime’).
- [T1057 ] Process Discovery – The rootkit hid process listings by hooking getdents64() and maintaining hidden PID maps (‘hidden_pids’).
- [T1564.001 ] Hidden Files and Directories – The rootkit concealed binaries from directory listings (‘hidden_names’).
- [T1014 ] Rootkit – The campaign deployed an eBPF rootkit to hide processes, files, and sockets (‘It deployed an eBPF program … that hooked getdents64()’).
- [T1049 ] System Network Connections Discovery – The payload inspected and then hid sockets using NETLINK_SOCK_DIAG (‘It also used NETLINK_SOCK_DIAG to sweep its network connections out of socket visibility’).
- [T1497.001 ] System Checks: Debugger Detection – Anti-debugging checks looked for tracing tools (‘The binary checks for debuggers using PTRACE_ATTACH and PTRACE_SEIZE’).
Indicators of Compromise
- [npm package names] Malicious or associated package names used in the campaign – atomic-lockfile, js-digest, and nextfile-js
- [package command strings] Package-install patterns used in the waves – npm install atomic-lockfile minimist chalk, bun install js-digest, and ‘b”u”n’ add nextfile-js
- [SHA-256] ELF payload hashes – 6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b, 7883bda1ff15425f2dbe622c45a3ae105ddfa6175009bbf0b0cad9bf5c79b316
- [MD5] ELF payload hash for the Wave 1 binary – 42b59fdbe1b72895b2951412222ebf40
- [Tor .onion domain] Command-and-control endpoint for stolen data – olrh4mibs62l6kkuvvjyc5lrercqg5tz543r4lsw3o6mh5qb7g7sneid.onion
- [HTTP paths] Exfiltration and callback paths – POST /api/agent and POST /upload
- [Filesystem paths] eBPF rootkit indicators – /sys/fs/bpf/hidden_pids, /sys/fs/bpf/hidden_names, and /sys/fs/bpf/hidden_inodes
- [Binary/source strings] Anti-debug and rootkit strings found in the payload – PTRACE_ATTACH, PTRACE_SEIZE, NETLINK_SOCK_DIAG, and scales.bpf.c
- [Persistence settings] systemd service behavior – Restart=always and RestartSec=30
- [npm account] Publish account used for the fake package – herbsobering
Read more: https://guardsix.com/blog/atomic-arch-zombie-package-apocalypse