Malware

deps

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

28 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence4

Злоумышленники перехватили управление заброшенными проектами, сохранили их названия и историю изменений, а затем изменили PKGBUILD-файлы таким образом, чтобы при сборке пакета загружалась и запускалась малварь.

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

The attackers adopted abandoned packages, edited the build files, and let users run the payload for them.

Execution

4 techniques

T1059.007JavaScriptEvidence1

atomic-lockfile ‘s package.json contains a preinstall lifecycle hook: "preinstall": "./src/hooks/deps"

T1106Native APIEvidence1

npm automatically runs that hook before installing the package which directly executes the malicious ELF binary.

T1127Trusted Developer Utilities Proxy ExecutionEvidence1

A user runs their AUR helper ( yay , paru , or raw makepkg ) to install or update a package.

T1204User ExecutionEvidence1

Build the package, and the binary runs... The attackers adopted abandoned packages, edited the build files, and let users run the payload for them.

Persistence

3 techniques

T1543Create or Modify System ProcessEvidence2

For persistence, it installs a systemd service with Restart=always. With root it copies itself under /var/lib/ and writes a unit under /etc/systemd/system/; as a normal user it uses the home directory and a per-user unit under ~/.config/systemd/user/.

T1543.002Systemd ServiceEvidence3

Для закрепления в системе малварь создавала systemd-службу с автоматическим перезапуском. Если процесс выполнялся с правами root, вредонос копировал себя в каталог /var/lib/ и создавал системный юнит в /etc/systemd/system/. При запуске от имени обычного пользователя использовался домашний каталог и пользовательские службы systemd.

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence depends on privilege level at execution time: Root: Copies itself to a generated path under /var/lib/ , installs a systemd service unit under /etc/systemd/system/ Non-root: Uses the current user’s home directory and installs a per-user systemd unit under ~/.config/systemd/user/

Privilege Escalation

3 techniques

T1543Create or Modify System ProcessEvidence2

T1543.002Systemd ServiceEvidence3

T1547Boot or Logon Autostart ExecutionEvidence1

Stealth

5 techniques

T1014RootkitEvidence4

Кроме того, внимание исследователей привлек встроенный eBPF-руткит... модуль является опциональным и загружается только при наличии необходимых привилегий. Руткит не использовался для повышения прав, но мог скрывать процессы, сетевые объекты и собственную активность от стандартных средств мониторинга.

T1127Trusted Developer Utilities Proxy ExecutionEvidence1

A user runs their AUR helper ( yay , paru , or raw makepkg ) to install or update a package.

T1218System Binary Proxy ExecutionEvidence1

This means a developer workstation, maintainer machine, or CI/build host could execute the malware as a side effect of building or installing the compromised AUR package.

T1564Hide ArtifactsEvidence2

Руткит ... мог скрывать процессы, сетевые объекты и собственную активность от стандартных средств мониторинга.

T1622Debugger EvasionEvidence2

it kills attempts to attach a debugger.

Credential Access

6 techniques

T1528Steal Application Access TokenEvidence2

извлекал информацию из Slack, Discord и Microsoft Teams, воровал токены GitHub, npm, HashiCorp Vault и OpenAI

T1539Steal Web Session CookieEvidence3

Вредонос похищал cookie, токены и данные локального хранилища Chromium-браузеров

T1552Unsecured CredentialsEvidence2

It collects: SSH keys, known_hosts, and shell histories Docker and Podman credentials and VPN profiles

T1552.001Credentials In FilesEvidence2

It collects... GitHub, npm, and HashiCorp Vault tokens... SSH keys, known_hosts, and shell histories Docker and Podman credentials and VPN profiles

T1555Credentials from Password StoresEvidence1

The payload targets SSH keys, GitHub tokens, npm credentials, Docker and Podman auth, HashiCorp Vault tokens, browser session data, Slack, Discord, Microsoft Teams, Telegram, VPN config files, and shell histories.

T1649Steal or Forge Authentication CertificatesEvidence2

а также SSH-ключи

Discovery

3 techniques

T1057Process DiscoveryEvidence1

When deps runs with CAP_BPF (i.e., as root), it loads a kernel-level eBPF program that hides its own processes, process names, and socket inodes from userspace.

T1083File and Directory DiscoveryEvidence1

T1622Debugger EvasionEvidence2

it kills attempts to attach a debugger.

Collection

1 technique

T1560Archive Collected DataEvidence1

Collector results are serialized into shared output objects and sent as POST /api/agent to the onion C2

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence2

Command and control runs through a Tor onion service via a local loopback proxy.

T1090ProxyEvidence3

Command and control runs through a Tor onion service via a local loopback proxy.

T1090.003Multi-hop ProxyEvidence2

связь с управляющей инфраструктурой злоумышленников была организована через Tor

T1105Ingress Tool TransferEvidence1

its PKGBUILD or .install script was edited to run npm install atomic-lockfile during the build, pulling the malicious npm package alongside a couple of legitimate ones for cover.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

Украденные данные передавались на внешний сервер, а связь с управляющей инфраструктурой злоумышленников была организована через Tor.

T1048Exfiltration Over Alternative ProtocolEvidence2

Stolen files go out over HTTP to temp.sh.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app18 days ago

hash.sha256●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

xakepNews

Jun 15, 2026

Более 400 пакетов для Arch Linux распространяли руткит и инфостилер - Хакер

Rust ELF payload launched by the malicious atomic-lockfile package. Functions as an infostealer targeting developer workstations and build systems, persists via systemd, communicates through Tor-backed C2/exfiltration infrastructure, and includes an optional eBPF rootkit component to hide processes and network activity.

thecybersecguruNews

Jun 12, 2026

Atomic Arch: 900+ AUR Packages Backdoored with eBPF RootkitCopy | The CyberSec Guru

A Rust-compiled Linux ELF credential stealer delivered through compromised AUR package build flows via malicious npm lifecycle hooks. It steals developer secrets, browser and collaboration-app data, establishes persistence with systemd, communicates with a Tor onion C2, and can load an eBPF rootkit to hide its processes and sockets when run with sufficient privileges.

bleeping computerNews

Jun 12, 2026

Over 400 Arch Linux packages compromised to push rootkit, infostealer

A Linux ELF payload dropped by atomic-lockfile that functions as a credential stealer and supports optional root-only eBPF rootkit features, including hiding processes, files, and network interfaces while collecting sensitive credentials and tokens for exfiltration.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping28

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

deps

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

28 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence4

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

The attackers adopted abandoned packages, edited the build files, and let users run the payload for them.

Execution

4 techniques

T1059.007JavaScriptEvidence1

atomic-lockfile ‘s package.json contains a preinstall lifecycle hook: "preinstall": "./src/hooks/deps"

T1106Native APIEvidence1

npm automatically runs that hook before installing the package which directly executes the malicious ELF binary.

T1127Trusted Developer Utilities Proxy ExecutionEvidence1

A user runs their AUR helper ( yay , paru , or raw makepkg ) to install or update a package.

T1204User ExecutionEvidence1

Build the package, and the binary runs... The attackers adopted abandoned packages, edited the build files, and let users run the payload for them.

Persistence

3 techniques

T1543Create or Modify System ProcessEvidence2

T1543.002Systemd ServiceEvidence3

T1547Boot or Logon Autostart ExecutionEvidence1

Privilege Escalation

3 techniques

T1543Create or Modify System ProcessEvidence2

T1543.002Systemd ServiceEvidence3

T1547Boot or Logon Autostart ExecutionEvidence1

Stealth

5 techniques

T1014RootkitEvidence4

T1127Trusted Developer Utilities Proxy ExecutionEvidence1

A user runs their AUR helper ( yay , paru , or raw makepkg ) to install or update a package.

T1218System Binary Proxy ExecutionEvidence1

This means a developer workstation, maintainer machine, or CI/build host could execute the malware as a side effect of building or installing the compromised AUR package.

T1564Hide ArtifactsEvidence2

T1622Debugger EvasionEvidence2

it kills attempts to attach a debugger.

Credential Access

6 techniques

T1528Steal Application Access TokenEvidence2

извлекал информацию из Slack, Discord и Microsoft Teams, воровал токены GitHub, npm, HashiCorp Vault и OpenAI

T1539Steal Web Session CookieEvidence3

Вредонос похищал cookie, токены и данные локального хранилища Chromium-браузеров

T1552Unsecured CredentialsEvidence2

It collects: SSH keys, known_hosts, and shell histories Docker and Podman credentials and VPN profiles

T1552.001Credentials In FilesEvidence2

It collects... GitHub, npm, and HashiCorp Vault tokens... SSH keys, known_hosts, and shell histories Docker and Podman credentials and VPN profiles

T1555Credentials from Password StoresEvidence1

T1649Steal or Forge Authentication CertificatesEvidence2

а также SSH-ключи

Discovery

3 techniques

T1057Process DiscoveryEvidence1

When deps runs with CAP_BPF (i.e., as root), it loads a kernel-level eBPF program that hides its own processes, process names, and socket inodes from userspace.

T1083File and Directory DiscoveryEvidence1

T1622Debugger EvasionEvidence2

it kills attempts to attach a debugger.

Collection

1 technique

T1560Archive Collected DataEvidence1

Collector results are serialized into shared output objects and sent as POST /api/agent to the onion C2

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence2

Command and control runs through a Tor onion service via a local loopback proxy.

T1090ProxyEvidence3

Command and control runs through a Tor onion service via a local loopback proxy.

T1090.003Multi-hop ProxyEvidence2

связь с управляющей инфраструктурой злоумышленников была организована через Tor

T1105Ingress Tool TransferEvidence1

its PKGBUILD or .install script was edited to run npm install atomic-lockfile during the build, pulling the malicious npm package alongside a couple of legitimate ones for cover.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

T1048Exfiltration Over Alternative ProtocolEvidence2

Stolen files go out over HTTP to temp.sh.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app18 days ago

hash.sha256●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

xakepNews

Jun 15, 2026

Более 400 пакетов для Arch Linux распространяли руткит и инфостилер - Хакер

thecybersecguruNews

Jun 12, 2026

Atomic Arch: 900+ AUR Packages Backdoored with eBPF RootkitCopy | The CyberSec Guru

bleeping computerNews

Jun 12, 2026

Over 400 Arch Linux packages compromised to push rootkit, infostealer

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping28

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.