Atomic Arch Supply Chain Campaign Hijacks 400+ Linux Packages to Deploy Rootkit and Credential Stealer

A supply chain campaign called Atomic Arch has compromised more than 400 Arch Linux AUR packages by exploiting the repository's own orphaned-package adoption process — no account breach required. The malware, a Rust-written credential stealer with optional eBPF rootkit capabilities, targets developer SSH keys, browser sessions, GitHub tokens, and cloud credentials; the affected package count may reach 1,500 across two waves.