Hello and welcome to the Monday, June 15th,

2006 edition of the Sands International Storm Center's Stormcast.

My name is Johannes Ulrich, recorded day from Jacksonville, Florida.

And this episode is brought you by the Sands.edu credit certificate program in cyber defense operations.

Well, and sadly, yet again, we have to start the week with a supply chain compromise.

And this one is a little bit different.

It actually affects a popular Linux distribution, Arch Linux.

Now, Arch Linux has this system. They're calling Arch User Repository or AUR. This is a place where users can essentially create their

own packages. So these are not official packages that are delivered as part of ARCH Linux.

And then, of course, with a lot of these open source project, there's always a risk of

packages being abandoned and then no longer being maintained. So to solve this ARCH user repository

has a system where a package can be marked as abandoned, no longer maintained,

and then any developer can step up and basically take on ownership of this particular

repository.

Now, many of them, of course, are hardly used.

But what happened here with Atomic Arch, this campaign that Sonatipe here wrote about,

is that attackers picked abandoned packages

that were somewhat popular, and then instead of modifying actually the code in the package,

what they did is that they added a code to the post-install script in the package.

And that's sort of then how they basically added the malicious code.

They just had an NPM install atomic lock file, then also minimists and chalk that they

installed.

...