The loose thread is mundane. A perfectly ordinary AUR package, the kind you install once and forget, grows a build step that reaches for a JavaScript package manager. An AUR PKGBUILD has no honest reason to run `npm install` while building a native application. One package is a curiosity. The question that turns a curiosity into an investigation is the boring one: is this the only one?

The AUR is a public git forge, so the first move is free: walk the commit history and diff each latest revision against its last-good parent. The pattern that falls out is not one package but a shape, a recently adopted or hijacked maintainer, a single fresh commit, a build- or install-time fetch that was simply not there before. Clustering on that shape is what turns "a package" into "a campaign" and, eventually, into the roughly nineteen hundred records on this page.

Stripping the decoys leaves atomic-lockfile@1.4.2. Its package.json wires a `preinstall` hook to `./src/hooks/deps`, an ELF dropped in under an innocuous, plural, build-noise name (deps, dependencies) so it reads as tooling in a process list. That is the stage-two delivery: the AUR PKGBUILD is only the loader. From here the artefact stops being shell and starts being a compiled binary, which is where the easy reading ends.

The dropped ELF is a Rust credential stealer. It rakes SSH keys, GitHub and npm tokens, Vault and cloud credentials, Docker and Podman config, browser and Electron stores, Slack, Teams and Discord material, and shell histories, then exfiltrates over the Tor channel with temp.sh as a fallback drop. It persists via a systemd unit (Restart=always, RestartSec=30); run as root it additionally loads an eBPF rootkit that pins hidden_pids, hidden_names and hidden_inodes under /sys/fs/bpf so /proc and /proc/net/tcp lie about it. On a developer’s box, the SSH keys and tokens are the crown jewels; the wallet theft (a swapped /usr/bin/monero-wallet-gui) is almost an afterthought.

Mid-investigation the package list is a moving target, and worse, a later wave stops matching the greps that found the first one. Searching history for `bun` or `npm install` quietly returns less than it should. That absence is itself the signal: the operators read the same public history the defenders did and adapted to it.

Attribution comes from the hijack itself. On a malicious revision the AUR Maintainer field has been overwritten, so the current value is the attacker’s and the previous value is the victim. inadyn-mt is the pattern in one diff: maintainer flips from Marcin Wieczorek <marcin@marcin.co> (the real, impersonated maintainer) to <vyindpettersen@gmail.com>, with `depends=(bun)` and a fresh install hook added alongside. Across the npm arm the same operation surfaces as the publisher herbsobering, the GHCR owner fardewoak, and the handle cypriangula. We attribute the accounts. We do not pretend a free-mail address typed into a hijacked field is a known human.

What survives the dead ends: on the order of nineteen hundred malicious AUR records and roughly three hundred and sixty linked actor accounts, a Rust stealer with an optional eBPF rootkit and a Tor C2, an npm second stage, and a clear hijack-versus-victim ledger. What it cost the ecosystem in trust is real. What it did not touch is worth saying as loudly: the official Arch repositories, signed and maintainer-gated, were never in scope, and neither were the curated overlays. The AUR is user content and always told you so. The fix is not "stop using the AUR", it is "read the PKGBUILD", which was always the deal.