More than 400 packages in the Arch User Repository were silently compromised in June 2026 — the largest open-source supply chain attack of the year. Credential harvesters, eBPF rootkits, and PKGBUILD manipulation that no version check would catch.
Quick Answer
Attackers hijacked 400+ AUR maintainer accounts (likely credential stuffing or session theft) and rewrote PKGBUILD build scripts — package names, versions, and histories stayed identical, so normal updates looked clean. The tampered scripts fetched and ran a Rust-based credential harvester targeting SSH keys, cloud creds, and CI/CD secrets; where builds ran as root, an eBPF rootkit loaded into the kernel for near-invisible persistence. If you built any AUR package on or after June 11, 2026: cross-check the official compromised-packages list, audit cached PKGBUILDs, rotate every credential, and enumerate eBPF programs with bpftool — rebuild from a known-good image if you can’t verify cleanliness.
What Happened: The Attack in Brief
On June 11, 2026, security researchers discovered that attackers had compromised over 400 packages in the Arch User Repository (AUR), the community-driven repository used by millions of Arch Linux users. The attackers didn’t exploit a software vulnerability — they hijacked the trust model itself.
Instead of modifying packaged software or injecting malicious binaries into build output, they rewrote the PKGBUILD scripts — the build recipes AUR users run on their own machines. The tampered scripts silently downloaded and executed a Rust-based credential harvester during compilation. On systems where the build ran with root privileges, the malware escalated further by loading an eBPF rootkit into the kernel, making itself nearly invisible to traditional security tools.
How the Attack Works
Phase 1 — Account Takeover
Attackers gained access to AUR maintainer accounts. The exact method isn’t publicly confirmed, but the scale suggests either credential stuffing against password-reusing maintainers or session hijacking via stolen tokens. The official Arch repositories were not affected — this attack exclusively targeted the community-maintained AUR.
Phase 2 — PKGBUILD Manipulation
The key insight: package names, versions, descriptions, and histories remained identical. A pacman -Syu or yay -Syu showed normal updates. Only the PKGBUILD changed — the instructions that tell your machine how to compile the software. The malicious additions typically lived in a prepare() or build() function that downloaded a compiled Rust binary from an attacker-controlled server, executed it alongside the legitimate build, and cleaned up after itself to avoid leaving traces in build logs.
Phase 3 — Credential Harvesting
The deployed malware targeted developer secrets specifically: SSH keys and configs (~/.ssh/), Git credentials (~/.gitconfig, tokens), cloud provider credentials (AWS, GCP, Azure CLI configs), application secrets (.env, .npmrc, .pypirc), Kubernetes configs and service account tokens, Docker registry credentials, and CI/CD pipeline secrets.
Phase 4 — eBPF Rootkit
Where makepkg ran as root, the malware deployed an eBPF rootkit operating at the kernel level: hiding processes from ps and top, filtering connections from netstat and ss, intercepting and modifying syscalls without touching any userspace binary, and surviving reboots. Not the first eBPF rootkit — but a significant evolution in Linux supply chain attacks.
How It Compares to Recent Supply Chain Attacks
| Attack | Vector | Scope | Motivation |
|---|---|---|---|
| xz-utils backdoor (CVE-2024-3094) | Social-engineered maintainer takeover | Single critical package, near-universal reach | Covert backdoor |
| Node-IPC protestware (2022) | Maintainer sabotaged own package | Single package chain | Political protest |
| SolarWinds (2020) / Codecov (2021) | Centralized build system / CI pipeline | Vendor-wide distribution | Intelligence gathering |
| AUR hijack (June 2026) | Mass maintainer-account takeover → PKGBUILD rewrite | 400+ packages at once | Criminal — credential theft at scale |
Traditional supply chain attacks targeted centralized build systems; the AUR attack exploits the decentralized trust model of community repositories. Users are designed to review PKGBUILDs before building — in practice, most blindly run makepkg -si or use AUR helpers that skip review entirely. For more June 2026 supply chain campaigns, see the Shai-Hulud PyPI attack breakdown and our software supply chain security guide.
Are You Affected? Four Steps
1. Check the Affected Package List
The Arch Linux security team maintains a live list of compromised packages — still growing as investigators identify more. If you installed or updated any AUR package on or after June 11, 2026, cross-reference every package name against the official list before trusting the host. Check back frequently.
2. Audit Your Build Environment
For any system that built AUR packages after June 11: review all PKGBUILDs in ~/.cache/yay/ or ~/.cache/paru/, check for unexpected network connections from build processes, inspect /var/log/pacman.log for suspicious activity, and review sudo logs for makepkg run as root.
3. Rotate All Credentials
If compromised — or if you can’t verify cleanliness: rotate all SSH keys, revoke and regenerate cloud API keys, update Git and personal access tokens, reset CI/CD secrets and deployment keys, review access logs on connected services, and treat the host as untrusted: rebuild from a known-good image.
4. Hunt for the eBPF Rootkit
Standard antivirus won’t catch eBPF rootkits. Use bpftool prog list and bpftool map list to enumerate loaded eBPF programs and maps, compare /proc listings with eBPF hook output for discrepancies, run Tracee or Falco for runtime eBPF monitoring, and check /sys/kernel/debug/tracing/ for attached tracepoints.
Open Source Supply Chain Security in Crisis
The AUR hosts roughly 80,000 packages maintained by thousands of volunteers — with no mandatory code review, no mandatory maintainer 2FA, and no repository-level PKGBUILD scanning. The security model assumes users review build scripts before execution; that assumption hasn’t held for years. The same patterns span PyPI (400,000+ packages, routine typosquatting and dependency confusion), npm (2M+ packages, frequent account takeover and protestware), and CRAN, RubyGems, and crates.io.
What Needs to Change
- Mandatory 2FA/MFA for all package maintainer accounts across every registry
- PKGBUILD signing — maintainers sign build scripts; AUR helpers verify signatures before execution
- Automated scanning of build scripts for network fetches, binary downloads, and privileged operations
- Reproducible builds with deterministic output for community verification
- Build sandboxing — AUR helpers should run builds in isolated containers by default
- Supply chain attestations using SLSA-style frameworks
Lessons for Every Developer
- Never run untrusted builds as root — the single most impactful change; if a build script needs root, treat that as a red flag
- Generate SBOMs — Syft, Trivy, and Grype document every component; you can’t protect what you can’t see
- Monitor for eBPF abuse — track eBPF program loading in production, the new frontier of Linux persistence
- Practice credential hygiene — short-lived credentials, hardware keys, secret managers over files
- Review before you build — scan any build script you didn’t write for
curl,wget,eval, andchmod +x
Frequently Asked Questions
How many AUR packages were hijacked in the June 2026 attack?
Over 400 packages in the Arch User Repository were compromised after attackers took over maintainer accounts and rewrote the PKGBUILD build scripts. Discovered June 11, 2026, it’s the largest open-source supply chain attack of the year by package count. The official Arch repositories were not affected — only the community-maintained AUR.
Why didn’t version checks catch the tampered packages?
The attackers changed only the PKGBUILD — the build recipe — while package names, versions, descriptions, and histories stayed identical. A normal pacman -Syu or yay -Syu showed nothing unusual. The malicious code executed during compilation via injected prepare() or build() functions, then cleaned up after itself to keep build logs clean.
What does the eBPF rootkit do?
On systems where makepkg ran as root, the malware loaded an eBPF rootkit into the kernel. It hides processes from ps and top, filters network connections from netstat and ss, intercepts and modifies syscalls without touching userspace binaries, and persists across reboots. Detect it with bpftool, Tracee, or Falco — standard antivirus won’t see it.
Which credentials did the AUR malware steal?
The Rust-based harvester targeted developer secrets: SSH keys (~/.ssh/), Git tokens and gitconfig, AWS/GCP/Azure CLI credentials, .env files, .npmrc, .pypirc, Kubernetes configs and service account tokens, Docker registry credentials, and CI/CD pipeline secrets. If you built AUR packages after June 11, 2026, rotate all of these and assume the host is untrusted.
References
- Arch Linux Security — AUR compromised package advisory, June 2026
- Aqua / foundational eBPF rootkit research
- OpenSSF — supply chain integrity and SLSA framework
- Hmmnm — Chrome Zero-Day & Shai-Hulud PyPI Supply Chain Attacks
- Hmmnm — Software Supply Chain Security: Dependencies, Builds, Secrets
- Hmmnm — Node-IPC Supply Chain Attack
- Hmmnm — Cybersecurity Threat Landscape June 2026
