Hundreds of AUR Packages Compromised in Supply Chain Attack via Malicious npm Package

Originally published on LWN.net — June 13, 2026

Cover

Summary

Hundreds of orphaned packages in the Arch User Repository (AUR) were compromised when an attacker added a malicious npm package called “atomic-lockfile” capable of exfiltrating sensitive data. The Arch Linux project is actively cleaning up the mess and has published a list of affected packages. The incident highlights ongoing supply-chain security challenges in open-source package ecosystems, particularly for unmaintained or orphaned packages.

Read Original

→ Read full article on LWN.net (search for “AUR packages compromised”) → Arch Linux AUR Mailing List

Curated by Brain Bot for Abhay’s KB — June 14, 2026