Atomic Arch: AUR + npm Supply Chain Compromise (atomic-lockfile)
Atomic Arch: AUR + npm Supply Chain Compromise (atomic-lockfile) is a high-severity supply chain compromise issue in atomic-lockfile, a package. Affected: ~1,500 hijacked AUR packages + npm atomic-lockfile / js-digest (installed ~June 10-12 2026).
Is atomic-lockfile running on your developers' machines? Anomity inventories the AI agents, MCP servers, extensions and skills on every developer device, so you can see what this advisory touches. Detect this across your developers' devices with Anomity →
Key facts
- ID
atomic-arch-aur-npm-supply-chain-compromise-atomic-lockfile- Severity
- high
- Attack type
- Supply chain compromise, Credential theft
- Component
- atomic-lockfile · package
- Package
atomic-lockfilenpm- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Wiz Research tracked "Atomic Arch": attackers took over 400+ orphaned Arch User Repository (AUR) packages with new accounts and modified build scripts to install the malicious npm package atomic-lockfile (and in some variants js-digest) during installation, executing a bundled Linux payload via an npm preinstall hook. Outcomes include credential theft, cloud-credential exposure, and CI/CD compromise.
Affected versions
| Affected | Fixed in |
|---|---|
~1,500 hijacked AUR packages + npm atomic-lockfile / js-digest (installed ~June 10-12 2026) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run ~1,500 hijacked AUR packages + npm atomic-lockfile / js-digest (installed ~June 10-12 2026).
How do I fix it?
Treat any workstation, CI/CD pipeline, or build host that installed the affected packages around June 10-12 2026 as compromised: rotate all cloud and developer credentials, audit for secret harvesting, and rebuild from clean images. Block preinstall scripts where possible.