Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
Medium Severity
Global
Date OccurredJun 12, 202619:33 UTC
Event TypeCyber Intelligence
SourceTheHackerNews
RecordedJun 12, 2026
Full Description
Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them.
The malware is a