cross-posted from: https://discuss.tchncs.de/post/62150833
Decided to create a thread for tracking and sharing the news and opinions on the new Malicious Atomic Arch NPM Campaign in which more than 1600 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit.
Find the infected packages: https://md.archlinux.org/s/SxbqukK6IA
Most popular packages on the affected list
Package Popularity Affected Reverted libgdata 16.98% (2026-06-11 14:59+00:00) (2026-06-11 17:30+00:00) python-future 5.38% (2026-06-11 15:58+00:00) (2026-06-11 16:54+00:00) gdl 3.36% (2026-06-11 13:35+00:00) (2026-06-11 17:32+00:00) libquvi-scripts 2.31% (2026-06-11 15:05+00:00) (2026-06-11 17:33+00:00) libquvi 2.22% (2026-06-11 15:04+00:00) (2026-06-11 17:33+00:00) gtkimageview 2.19% (2026-06-11 13:44+00:00) (2026-06-11 17:33+00:00) python2-pyparsing 2.02% (2026-06-11 14:23+00:00) (2026-06-11 17:40+00:00) python2-appdirs 1.96% (2026-06-11 14:22+00:00) (2026-06-11 17:26+00:00) compiler-rt19 1.95% (2026-06-11 14:23+00:00) (2026-06-11 17:30+00:00) python2-packaging 1.90% (2026-06-11 14:21+00:00) (2026-06-11 17:38+00:00) wine-nine 1.86% (2026-06-11 15:48+00:00) (2026-06-11 21:36+00:00) clang19 1.86% (2026-06-11 15:36+00:00) (2026-06-11 21:24+00:00) clang15 1.76% (2026-06-12 12:34+00:00) (2026-06-12 12:54+00:00) mono-addins 1.69% (2026-06-11 15:33+00:00) (2026-06-11 21:34+00:00) python2-chardet 1.68% (2026-06-12 12:42+00:00) (2026-06-12 14:48+00:00) python-monotonic 1.55% (2026-06-11 15:43+00:00) (2026-06-11 21:37+00:00) python2-cffi 1.47% (2026-06-12 12:44+00:00) (2026-06-12 15:10+00:00) alvr 1.26% (2026-06-11 13:54+00:00) (2026-06-11 16:50+00:00) python2-gobject 1.23% (2026-06-12 12:44+00:00) (2026-06-12 14:47+00:00) vidcutter 1.03% (2026-06-11 13:24+00:00) (2026-06-11 17:43+00:00)Learn more about the attack: https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency.
I agree with you, nobody should disable readonly mode and tinker with system packages (and I do not mean Flatpak). However there is an alternative to this and officially supported. Valve added an exception to Nix package manager, that you can use to install packages from Nix repository and update them without pacman. And it will remain even after a system update, without disabling readonly system.
My comment was about AUR packages tho. Heck, the entire thread is.
I know, and I answered accordingly. I gave an alternative to install packages, because its not recommended to use AUR on Steam Deck.