Decided to create a thread for tracking and sharing the news and opinions on the new Malicious Atomic Arch NPM Campaign in which more than 1600 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit.
Find the infected packages: https://md.archlinux.org/s/SxbqukK6IA
Most popular packages on the affected list
Package Popularity Affected Reverted
libgdata 16.98% (2026-06-11 14:59+00:00) (2026-06-11 17:30+00:00)
python-future 5.38% (2026-06-11 15:58+00:00) (2026-06-11 16:54+00:00)
gdl 3.36% (2026-06-11 13:35+00:00) (2026-06-11 17:32+00:00)
libquvi-scripts 2.31% (2026-06-11 15:05+00:00) (2026-06-11 17:33+00:00)
libquvi 2.22% (2026-06-11 15:04+00:00) (2026-06-11 17:33+00:00)
gtkimageview 2.19% (2026-06-11 13:44+00:00) (2026-06-11 17:33+00:00)
python2-pyparsing 2.02% (2026-06-11 14:23+00:00) (2026-06-11 17:40+00:00)
python2-appdirs 1.96% (2026-06-11 14:22+00:00) (2026-06-11 17:26+00:00)
compiler-rt19 1.95% (2026-06-11 14:23+00:00) (2026-06-11 17:30+00:00)
python2-packaging 1.90% (2026-06-11 14:21+00:00) (2026-06-11 17:38+00:00)
wine-nine 1.86% (2026-06-11 15:48+00:00) (2026-06-11 21:36+00:00)
clang19 1.86% (2026-06-11 15:36+00:00) (2026-06-11 21:24+00:00)
clang15 1.76% (2026-06-12 12:34+00:00) (2026-06-12 12:54+00:00)
mono-addins 1.69% (2026-06-11 15:33+00:00) (2026-06-11 21:34+00:00)
python2-chardet 1.68% (2026-06-12 12:42+00:00) (2026-06-12 14:48+00:00)
python-monotonic 1.55% (2026-06-11 15:43+00:00) (2026-06-11 21:37+00:00)
python2-cffi 1.47% (2026-06-12 12:44+00:00) (2026-06-12 15:10+00:00)
alvr 1.26% (2026-06-11 13:54+00:00) (2026-06-11 16:50+00:00)
python2-gobject 1.23% (2026-06-12 12:44+00:00) (2026-06-12 14:47+00:00)
vidcutter 1.03% (2026-06-11 13:24+00:00) (2026-06-11 17:43+00:00)
Learn more about the attack: https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency.
Analyzing the commit history of
libdata, you can see the attacker pushed the malicious PKGBUILD on Jun 11, 2026 14.59 GMT. And it was reverted back to the previous commit on the same day, about 2.5 hours later, on Jun 11, 2026 at 17:30 GMT.So it seems like if you updated the libgdata package during this period, your system might be affected.
Edit: Commit history: https://github.com/archlinux/aur/activity?ref=libgdata