AUR Supply-Chain Hit: 400+ Arch Packages Backdoored With Rust Stealer, Optional eBPF Rootkit

More than 400 packages in the Arch User Repository were taken over this week and rewired to pull a credential stealer onto any machine that built them.

The AUR is community-maintained. It sits outside Arch's official repos, which limits blast radius but also means each PKGBUILD is whatever its maintainer says it is. That trust model is the entire story here.

Attackers modified build scripts on the compromised packages to fetch and execute a Rust binary during installation. The payload is a stealer focused on developer secrets: SSH keys, shell history, cloud credentials, browser data, and tokens sitting in dotfiles. Standard fare for the current commodity Linux infostealer scene, but compiled in Rust and shipped through a trusted-by-default channel.

When the build runs as root — which makepkg discourages but plenty of CI pipelines and lazy workstations still do — the implant escalates. In that path it can deploy an eBPF-based rootkit to hide processes, files, and network sockets from userland tooling. eBPF rootkits aren't new, but they continue to chew through detection coverage on Linux endpoints where EDR is thin.

Attribution is open. I have not seen any vendor publicly cluster this activity to a named group, and the tradecraft — mass package hijack, off-the-shelf-looking Rust stealer, eBPF stage gated on privilege — overlaps with both criminal supply-chain crews and the kind of opportunistic pre-positioning DPRK-nexus clusters like the one tracked as Contagious Interview (Mandiant) / Famous Chollima (CrowdStrike) have been running against developers all year. Overlap is not attribution. Treat any claim of a specific actor as low confidence until someone publishes infrastructure or a hash list.

What is clear is capability versus intent. The capability is broad credential theft on Linux developer workstations with optional kernel-level persistence. The intent, based on collection targets, looks like access brokering or follow-on intrusion against whatever those credentials unlock — cloud tenants, source forges, internal registries.

If you build from the AUR, assume any package you installed or rebuilt this week is suspect until you've checked the PKGBUILD diff against a known-good commit. Rotate SSH keys, cloud tokens, and any credentials cached on affected hosts. Look for unexpected outbound connections from build environments, unfamiliar systemd units, and unusual eBPF programs loaded on the host (bpftool prog show).

The AUR maintainers have been removing the malicious packages as they're identified. Expect the list to grow before it stabilizes. This is the second AUR poisoning incident in recent memory, and it will not be the last as long as community repositories remain a soft underbelly of the Linux developer toolchain.

Medium confidence this is financially or access-motivated. Low confidence on any specific actor.