Threat actors compromised more than 400 packages in the Arch Linux User Repository (AUR) by injecting malicious install scripts that deploy an eBPF rootkit and credential harvester onto developer workstations. The malware targets SSH private keys, cloud secrets, container credentials, and messaging session tokens, assets that grant downstream access to CI/CD pipelines, code repositories, and enterprise infrastructure. A single compromised developer machine can become the entry point for a broader supply chain attack affecting every organization that consumes that developer’s code or infrastructure output.