INTEL_REPORT
LWN.net (kernel & development security) · published 6/12/2026, 1:41:22 PM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
Hundreds of AUR packages compromised Hundreds of orphaned packages hosted by the Arch User Repository (AUR) have been compromised by an attacker who has added a malicious npm package ( atomic-lockfile ) that can exfiltrate sensitive data. The project is currently working on cleaning up the mess. There is a list of affected packages and post (possibly NSFW domain) by "sodiboo" with additional information. Arch Linux users (or users of Arch-based distributions) that use AUR pa…
https://lwn.net/Articles/1077718
sha256:498fdd07d755c2de9d2d2be1a402b4c0aa39c88910ac6447706b7ad6301ee3ec
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.