Poisoned Pipeline / Incidents / AS201
Orphaned AUR packages adopted and rewritten to steal credentials
Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.
Mapped techniques
- T0109 Publish malicious artifact
supply-chain campaign
Named in the tstromberg supplychain-attack-data corpus with first-party references.
Sources
- https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency
- https://www.stepsecurity.io/blog/400-aur-packages-hijacked-atomic-arch-campaign
- https://www.truesec.com/hub/blog/supply-chain-attack-compromising-arch-linux-aur-packages-infostealer-rootkit
- https://cybersecuritynews.com/arch-linux-aur-packages-compromised/
- https://safedep.io/ti/campaigns/atomic-arch/