Over 400 Arch Linux packages compromised to push rootkit, infostealer

A threat actor compromised over 400 packages in the Arch User Repository by injecting a Linux rootkit and infostealer into build scripts. The malware uses eBPF to achieve kernel-level persistence, hide processes, and exfiltrate credentials and access tokens. Any Arch Linux user who installed affected AUR packages is potentially compromised with persistent root-level access.