deps
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
4 techniques
Execution
atomic-lockfile ‘s package.json contains a preinstall lifecycle hook: "preinstall": "./src/hooks/deps"
npm automatically runs that hook before installing the package which directly executes the malicious ELF binary.
Persistence
3 techniques
Persistence
For persistence, it installs a systemd service with Restart=always. With root it copies itself under /var/lib/ and writes a unit under /etc/systemd/system/; as a normal user it uses the home directory and a per-user unit under ~/.config/systemd/user/.
For persistence, it installs a systemd service with Restart=always. With root it copies itself under /var/lib/ and writes a unit under /etc/systemd/system/; as a normal user it uses the home directory and a per-user unit under ~/.config/systemd/user/.
Persistence depends on privilege level at execution time: Root: Copies itself to a generated path under /var/lib/ , installs a systemd service unit under /etc/systemd/system/ Non-root: Uses the current user’s home directory and installs a per-user systemd unit under ~/.config/systemd/user/
Privilege Escalation
3 techniques
Privilege Escalation
For persistence, it installs a systemd service with Restart=always. With root it copies itself under /var/lib/ and writes a unit under /etc/systemd/system/; as a normal user it uses the home directory and a per-user unit under ~/.config/systemd/user/.
For persistence, it installs a systemd service with Restart=always. With root it copies itself under /var/lib/ and writes a unit under /etc/systemd/system/; as a normal user it uses the home directory and a per-user unit under ~/.config/systemd/user/.
Persistence depends on privilege level at execution time: Root: Copies itself to a generated path under /var/lib/ , installs a systemd service unit under /etc/systemd/system/ Non-root: Uses the current user’s home directory and installs a per-user systemd unit under ~/.config/systemd/user/
Stealth
6 techniques
Stealth
When it does activate, it hides the malware's own processes, process names, and socket inodes from standard tools, using pinned BPF maps named hidden_pids, hidden_names, and hidden_inodes, and it kills attempts to attach a debugger.
The outer package is a largely functional TypeScript npm package (legitimate atomic-lockfile project) with the ELF binary inserted into its source tree.
A user runs their AUR helper ( yay , paru , or raw makepkg ) to install or update a package.
This means a developer workstation, maintainer machine, or CI/build host could execute the malware as a side effect of building or installing the compromised AUR package.
Credential Access
7 techniques
Credential Access
It collects: GitHub, npm, and HashiCorp Vault tokens, plus OpenAI/ChatGPT bearer material and account metadata
It collects: Cookies, tokens, and local storage from Chromium-based browsers (Chrome, Edge, Brave, and many more)
It collects: SSH keys, known_hosts, and shell histories Docker and Podman credentials and VPN profiles
It collects... GitHub, npm, and HashiCorp Vault tokens... SSH keys, known_hosts, and shell histories Docker and Podman credentials and VPN profiles
The payload targets SSH keys, GitHub tokens, npm credentials, Docker and Podman auth, HashiCorp Vault tokens, browser session data, Slack, Discord, Microsoft Teams, Telegram, VPN config files, and shell histories.
Discovery
3 techniques
Discovery
When deps runs with CAP_BPF (i.e., as root), it loads a kernel-level eBPF program that hides its own processes, process names, and socket inodes from userspace.
Collection
1 technique
Collection
Command and Control
5 techniques
Command and Control
Command and control runs through a Tor onion service via a local loopback proxy.
Collector results are serialized into shared output objects and sent as POST /api/agent to the onion C2 through a local loopback/SOCKS transport.
Exfiltration
2 techniques
Exfiltration
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Rust-compiled Linux ELF credential stealer delivered through compromised AUR package build flows via malicious npm lifecycle hooks. It steals developer secrets, browser and collaboration-app data, establishes persistence with systemd, communicates with a Tor onion C2, and can load an eBPF rootkit to hide its processes and sockets when run with sufficient privileges.
A Linux ELF payload dropped by atomic-lockfile that functions as a credential stealer and supports optional root-only eBPF rootkit features, including hiding processes, files, and network interfaces while collecting sensitive credentials and tokens for exfiltration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.