MEDIUMSupply Chain
Global

Atomic Arch npm Campaign Adds Malicious Dependency

·Source: Sonatype (Maven/npm)

Updated:

Executive Summary

Analysis

Sonatype researchers have identified a malicious package campaign, dubbed Atomic Arch, that targets orphaned packages in the Arch User Repository (AUR).

Indicators of Compromise (3)

URL (2)
https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency
VirusTotalURLhaus
https://www.sonatype.com/hubfs/RapidResponse_Templates_Malware%20%284%29.png
VirusTotalURLhaus
Domain (1)
www.sonatype.com
VirusTotalURLhaus
Source Attribution

Originally published by Sonatype (Maven/npm) on Jun 11, 2026.

Related Threats

MEDIUMSupply Chain

GitHub to Update npm to Thwart Software Supply Chain Attacks

NPM, part of GitHub, announced a new version of the npm package manager with several security improvements, including disabling install scripts

Infosecurity Magazine
MEDIUMSupply Chain

ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories

It's been one of those weeks. You expect the usual noise: recycled malware, sloppy attacks, another easy target getting hit. Instead, there's a supply chain attack kit in a public repo, a $5,000-a-month RAT that clones browsers, and research showing AI agents can be tricked into leaking real credentials. The bigger problem is how polished this all looks now. Mule networks run like SaaS.

The Hacker News
MEDIUMSupply Chain

ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Action Patch + 28 New Stories

It's been one of those weeks. You expect the usual noise: recycled malware, sloppy attacks, another easy target getting hit. Instead, there's a supply chain attack kit in a public repo, a $5,000-a-month RAT that clones browsers, and research showing AI agents can be tricked into leaking real credentials. The bigger problem is how polished this all looks now. Mule networks run like SaaS.

The Hacker News