Loading malware…
atomic-lockfile is a malicious npm package used in the June 2026 "Atomic Arch" supply-chain campaign targeting the Arch User Repository (AUR). Attackers hijacked orphaned AUR packages and modified PKGBUILD and related install scripts to fetch and install atomic-lockfile, including via npm install atomic-lockfile; the package’s package.json contained a preinstall hook that executed an embedded Linux ELF payload named deps from ./src/hooks/deps. The package was also associated with a later related wave involving js-digest delivered via bun install.
The deps payload is described as a stripped 64-bit Linux ELF written in Rust and analyzed as a full-featured infostealer aimed primarily at developer workstations and build systems. Reported theft targets include Chromium-family browser cookies, tokens, and local storage; data from Slack, Discord, Microsoft Teams, and Telegram; GitHub, npm, HashiCorp Vault, and OpenAI/ChatGPT credentials; SSH keys and known_hosts; shell history; Docker and Podman credentials; and VPN configuration files. The malware also queried legitimate APIs such as Slack, Teams, Discord, GitHub, and OpenAI/ChatGPT to validate or enrich stolen credentials.
The malware exfiltrated data to external infrastructure, including HTTP uploads to temp.sh, and used Tor-based command-and-control via a localhost proxy or SOCKS-style transport to a decoded onion service. It established persistence through systemd services configured for automatic restart. When run as root, it copied itself under /var/lib/ and created a unit under /etc/systemd/system/; when run as a regular user, it persisted from the user home directory using ~/.config/systemd/user/.
When sufficient privileges were available, the payload could optionally load an eBPF rootkit. This rootkit was reported to hide processes, process names, socket inodes, and related activity from standard monitoring tools, and to block debugger attachment. It was not used for privilege escalation. Reported artifacts included BPF maps or paths such as hidden_pids, hidden_names, hidden_inodes, and /sys/fs/bpf/hidden_*. One analyzed sample delivered via atomic-lockfile had SHA-256 6144D433F8A0316869877B5F834C801251BBB936E5F1577C5680878C7443C98B. The campaign has been linked by reporting to AUR package takeovers and to the malicious npm publisher account herbsobering.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
The Arch User Repository (AUR) suspended new registrations Monday due to an ongoing supply chain attack flooding the repository with more than 1,500 malicious packages.
According to Sonatype, the campaign started with abandoned packages in AUR, which were modified to execute a malicious NPM package during installation. By June 12, the attackers switched to Bun-based installation paths and also started pushing new malicious packages.
In an initial wave affecting about 400 packages, this script executed an npm install command for a package called atomic-lockfile. Shortly afterward, the attackers switched tactics, instead using the Bun runtime to install packages called js-digest and lockfile-js
Sonatype researchers say that the threat actor hijacked at least 20 orphaned packages on AUR and pushed atomic-lockfile by modifying the PKGBUILD file - a Bash script with the build information needed by Arch Linux packages.
atomic-lockfile ‘s package.json contains a preinstall lifecycle hook: "preinstall": "./src/hooks/deps"
Analysis identified references to an eBPF program ( scales.bpf.c ) and to libbpf APIs including: bpf_object__load bpf_program__attach bpf_map__pin
A user runs their AUR helper ( yay , paru , or raw makepkg ) to install or update a package.
They modified the packages' PKGBUILD to introduce a post-install script that executes npm install atomic-lockfile minimist chalk during package installation, causing affected systems to retrieve and install the npm package atomic-lockfile.
the attackers switched to Bun-based installation paths and also started pushing new malicious packages.
The Linux executable that runs during package installation as part of an Atomic Arch attack references eBPF (extended Berkeley Packet Filter), the technology that allows programs to run inside the Linux kernel with elevated privileges, likely for persistence purposes.
The rootkit-like malware also references credentials, SSH artifacts, HashiCorp Vault tokens, browser cookies, and data stores from popular collaboration applications
the hackers modified the packages’ PKGBUILD to introduce malicious behavior masquerading as the NPM package atomic-lockfile.
A user runs their AUR helper ( yay , paru , or raw makepkg ) to install or update a package.
This means a developer workstation, maintainer machine, or CI/build host could execute the malware as a side effect of building or installing the compromised AUR package.
Sonatype also observed functionality related to process, file, and network hiding
They modified the packages' PKGBUILD to introduce a post-install script that executes npm install atomic-lockfile minimist chalk during package installation, causing affected systems to retrieve and install the npm package atomic-lockfile.
the attack began Thursday when attackers abused AUR’s stewardship process for adopting orphaned packages to claim ownership of abandoned, legitimate packages and modify them with malicious PKGBUILD post-install scripts.
The binary contains references to GitHub credentials, SSH artifacts, HashiCorp Vault tokens, browser cookie databases, Slack, Discord, Microsoft Teams, and Telegram data stores.
The binary contains references to GitHub credentials, SSH artifacts, HashiCorp Vault tokens, browser cookie databases, Slack, Discord, Microsoft Teams, and Telegram data stores. Taken together, these references strongly indicate credential and token harvesting functionality.
The rootkit-like malware also references credentials, SSH artifacts, HashiCorp Vault tokens, browser cookies, and data stores from popular collaboration applications, suggesting it was designed for credential and secret harvesting and exfiltration.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious npm package used in compromised AUR packages to deploy a Rust ELF infostealer that steals browser cookies, tokens, local storage data, Slack/Discord/Microsoft Teams data, GitHub/npm/HashiCorp Vault/OpenAI tokens, SSH keys, shell history, VPN profiles, and Docker/Podman credentials; exfiltrates data to an external server over infrastructure using Tor; establishes persistence via systemd and may optionally deploy an eBPF rootkit for stealth.
A malicious npm package referenced in tampered AUR build scripts as part of the supply-chain attack chain. It was used to fetch or stage the malicious payload affecting Arch Linux users.
A trojanized npm package used in the Atomic Arch supply-chain attack. Version 1.4.2 included a malicious preinstall hook that automatically executed the embedded deps ELF payload during npm installation.
A malicious npm package delivered via compromised AUR packages that installs a Linux payload with credential-stealing and optional eBPF rootkit capabilities. It targets developer workstations and build environments, stealing browser and Electron app data, Slack, Microsoft Teams, Discord, GitHub, npm, Vault, Docker/Podman, SSH, VPN material, shell histories, cookies, and other local secrets, and appears capable of archiving and HTTP-based exfiltration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.