# atomic-arch-aur-npm-supply-chain-compromise-atomic-lockfile: Atomic Arch: AUR + npm Supply Chain Compromise (atomic-lockfile)

> Atomic Arch: AUR + npm Supply Chain Compromise (atomic-lockfile) is a high-severity supply chain compromise issue in atomic-lockfile, a package. Affected: ~1,500 hijacked AUR packages + npm atomic-lockfile / js-digest (installed ~June 10-12 2026).

- **Canonical URL:** https://catalog.anomity.ai/vuln/atomic-arch-aur-npm-supply-chain-compromise-atomic-lockfile
- **Aliases:** ti-039
- **Severity:** high
- **Attack type:** Supply chain compromise, Credential theft
- **Component:** atomic-lockfile (package)
- **Package:** atomic-lockfile (npm)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-06-12
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/atomic-arch-aur-npm-supply-chain-compromise-atomic-lockfile

## Summary

Wiz Research tracked "Atomic Arch": attackers took over 400+ orphaned Arch User Repository (AUR) packages with new accounts and modified build scripts to install the malicious npm package atomic-lockfile (and in some variants js-digest) during installation, executing a bundled Linux payload via an npm preinstall hook. Outcomes include credential theft, cloud-credential exposure, and CI/CD compromise.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| ~1,500 hijacked AUR packages + npm atomic-lockfile / js-digest (installed ~June 10-12 2026) | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run ~1,500 hijacked AUR packages + npm atomic-lockfile / js-digest (installed ~June 10-12 2026).

## How do I fix it?

Treat any workstation, CI/CD pipeline, or build host that installed the affected packages around June 10-12 2026 as compromised: rotate all cloud and developer credentials, audit for secret harvesting, and rebuild from clean images. Block preinstall scripts where possible.

## References

- article: https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency

## Related vulnerabilities

- [litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook](https://catalog.anomity.ai/vuln/litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook) — critical
- [memtensor-compromise-poisoned-openclaw-memory-plugin-and-memoryos](https://catalog.anomity.ai/vuln/memtensor-compromise-poisoned-openclaw-memory-plugin-and-memoryos) — critical
- [miasma-npm-worm-compromises-31-red-hat-cloud-services-packages-via-ci](https://catalog.anomity.ai/vuln/miasma-npm-worm-compromises-31-red-hat-cloud-services-packages-via-ci) — critical
- [mistralai-pypi-package-v2-4-6-backdoored-with-credential-stealer](https://catalog.anomity.ai/vuln/mistralai-pypi-package-v2-4-6-backdoored-with-credential-stealer) — critical
- [ghostaction-returns-a-security-audit-yml-workflow-pushed-from](https://catalog.anomity.ai/vuln/ghostaction-returns-a-security-audit-yml-workflow-pushed-from) — high
- [tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm](https://catalog.anomity.ai/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=atomic-arch-aur-npm-supply-chain-compromise-atomic-lockfile