{
  "entry": {
    "kind": "vuln",
    "slug": "atomic-arch-aur-npm-supply-chain-compromise-atomic-lockfile",
    "name": "atomic-arch-aur-npm-supply-chain-compromise-atomic-lockfile",
    "vendor": "atomic-lockfile",
    "description": "Wiz Research tracked \"Atomic Arch\": attackers took over 400+ orphaned Arch User Repository (AUR) packages with new accounts and modified build scripts to install the malicious npm package atomic-lockfile (and in some variants js-digest) during installation, executing a bundled Linux payload via an npm preinstall hook. Outcomes include credential theft, cloud-credential exposure, and CI/CD compromise.",
    "website": "https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "npm",
      "packageName": "atomic-lockfile",
      "command": null
    },
    "configFiles": null,
    "category": "package",
    "updatedAt": "2026-06-12",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "atomic-arch-aur-npm-supply-chain-compromise-atomic-lockfile",
      "aliases": [
        "ti-039"
      ],
      "title": "Atomic Arch: AUR + npm Supply Chain Compromise (atomic-lockfile)",
      "summary": "Wiz Research tracked \"Atomic Arch\": attackers took over 400+ orphaned Arch User Repository (AUR) packages with new accounts and modified build scripts to install the malicious npm package atomic-lockfile (and in some variants js-digest) during installation, executing a bundled Linux payload via an npm preinstall hook. Outcomes include credential theft, cloud-credential exposure, and CI/CD compromise.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft"
      ],
      "componentType": "package",
      "component": {
        "name": "atomic-lockfile",
        "vendor": null,
        "package": "atomic-lockfile",
        "ecosystem": "npm",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "~1,500 hijacked AUR packages + npm atomic-lockfile / js-digest (installed ~June 10-12 2026)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-06-12",
      "modifiedAt": "2026-06-12",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency"
        }
      ],
      "mitigation": "Treat any workstation, CI/CD pipeline, or build host that installed the affected packages around June 10-12 2026 as compromised: rotate all cloud and developer credentials, audit for secret harvesting, and rebuild from clean images. Block preinstall scripts where possible.",
      "detectedByAnomity": false
    }
  }
}