Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages

Arch Linux has suspended new user registrations on its community-driven Arch User Repository after more than fifteen hundred malicious packages were published in an ongoing supply chain attack called Atomic Arch. The attackers targeted abandoned packages, modifying them to install rootkit-like malware designed to harvest credentials, SSH artifacts, and browser data, while using Linux kernel technology to hide processes and maintain persistence with elevated privileges. Security experts warn that affected systems should be treated as fully compromised and rebuilt from clean media, as simple malware scans are insufficient to detect and remove the sophisticated threats.