Atomic Arch: One of the many supply chain attacks.
Abstract
On June 11, 2026, Sonatype researchers disclosed a large-scale supply chain attack against the Arch User Repository (AUR), dubbed Atomic Arch. Attackers systematically claimed ownership of abandoned AUR packages through AUR's standard orphan adoption process, then modified the packages' PKGBUILD files to inject a malicious npm dependency during installation. The dependency delivered a Rust-based infostealer and, when root access was available, an eBPF rootkit. By June 13, the estimated number of compromised packages had grown from 400 to approximately 1,500-1,600.
Keywords
Cybersecurity
Citation
0 CitationsDarden, A. (2026). Atomic Arch: One of the many supply chain attacks. Global Youth Science Journal, 3(5). https://doi.org/10.5281/zenodo.23536309
Darden, Asher. "Atomic Arch: One of the many supply chain attacks." Global Youth Science Journal, vol. 3, no. 5, 2026. https://doi.org/10.5281/zenodo.23536309.
Darden, Asher. "Atomic Arch: One of the many supply chain attacks." Global Youth Science Journal 3, no. 5 (2026). https://doi.org/10.5281/zenodo.23536309.
Darden, A. (2026) 'Atomic Arch: One of the many supply chain attacks', Global Youth Science Journal, 3(5). Available at: https://doi.org/10.5281/zenodo.23536309.
@article{GYSJ2026Darden,
title={Atomic Arch: One of the many supply chain attacks.},
author={Asher Darden},
journal={Global Youth Science Journal},
volume={3},
number={5},
year={2026},
url={https://doi.org/10.5281/zenodo.23536309}
}
TY - JOUR TI - Atomic Arch: One of the many supply chain attacks. JO - Global Youth Science Journal VL - 3 IS - 5 PY - 2026 UR - https://doi.org/10.5281/zenodo.23536309 AU - Asher Darden ER -
0 Comments
Recommended Articles
View all publicationsImpact of MNCs on MSMEs
This study investigated the economic and managerial impact of multinational corporation entry on micro, small and medium enterpris...
Quantum Gravity
General relativity and quantum mechanics provide highly successful descriptions of nature at macroscopic and microscopic scales, r...
Joint Multidrug-Resistance Information in Indian AMR Surveillance: Bounds from Marginal and Pairwise Susceptibility Data and a Temporal Validation
Antimicrobial-resistance surveillance summaries may report resistance separately by antibiotic while omitting the within-isolate c...
A Case Analysis of Byju’s Mass Layoffs: Examining the Enforceability of Employment Contracts and Severance Norms in India
The rapid growth of Byju’s made it one of India’s most prominent ed-tech companies, but its financial difficulties later resulted ...