A reverse shell dressed as a Firefox patch

A new AUR package maintainer spoofing a trusted maintainer adopted and infected more than 408 packages, according to a June 15 report from iFin Network.

The affected packages were modified through PKGBUILD-related changes that ran malicious install-time behavior. The first wave used preinstall scripts to call npm and install atomic-lockfile, described in the report as a malicious payload. Later infections used Bun to install another malicious dependency, js-digest, which npm has since removed. A third wave, identified on June 14 at 07:00 UTC, tried to obfuscate the Bun dependency.

That is a useful detail for defenders because it keeps the incident out of the category of vague “supply chain risk” and puts it into something concrete: package build scripts executing a language package manager during installation. If you install from the AUR, you are already trusting a PKGBUILD to run local commands. In this case, that trust path was used to pull in hostile JavaScript packages from the npm ecosystem.

The report says the attack included at least two separate malicious dependencies. It also gives a SHA256 hash for the malicious Linux executable embedded in js-digest:

7883bda1ff15425f2dbe622c45a3ae105ddfa6175009bbf0b0cad9bf5c79b316

The same report says the compromise showed both infostealer behavior and signs of a rootkit, specifically calling out suspicious eBPF maps. Suggested map names to hunt for include hidden_pids, hidden_names, and hidden_inodes. On Linux, eBPF can be used for legitimate observability and networking work, but a rootkit using it changes the response posture. Once the kernel-facing layer is potentially hiding process IDs, filenames, or inodes, normal host inspection becomes less persuasive.

The maintainer detail matters. An earlier version of the report said a known maintainer account was responsible for the malicious commits. The report now says that was inaccurate: the known maintainer account was spoofed. The actor was a new AUR package maintainer impersonating someone trusted, then adopting packages and changing them.

That adoption path is the operational weak spot described by the source. The AUR allows anyone to adopt a package and submit changes to the PKGBUILD and associated files when the package is marked unmaintained. The report notes that automating the search for abandoned packages and adopting them is not uncommon. That makes scale plausible without requiring a breach of every original maintainer account.

As of June 15, 2026 at 15:00 UTC, AUR registration was disabled. Other AUR maintainers were working to remove the infected packages.

For Arch users, the practical response starts with exposure. Review the affected package list from the original report and use the current checking script linked there, since the report marks the older aur_check.sh as outdated. If an affected package is found, treat the machine as compromised. The report’s recommended actions are credential rotation and considering a reinstall of Arch, because the possibility of a rootkit removes trust in the running system.

There are a few useful network and artifact angles. The report recommends denying outbound Tor traffic from the network. It also says Socket.dev recorded 134 downloads for the malicious npm package, and that the npm package was maintained by the user herbsobering. Searching that username on GitHub found a single container image that appeared to be a reverse shell or proxy tool.

The obfuscated Bun command in the third wave referenced nextfile-js, which Socket flagged as suspicious. The report says its package.json had the same preinstall script, likely the rootkit, as the other packages, although the repository itself did not appear to include the file.

For anyone running these systems, the narrow lesson is to review AUR build files before installing or upgrading, especially when a package has recently changed maintainers or starts invoking npm, Bun, or another package manager during build or install. The broader response is inventory: know which AUR packages are present, which ones were updated during the relevant window, and whether any of the listed indicators appear on disk or in eBPF map output.