Active Inline images AURA Ecosystem, Qubuhub gravatar.com/167559384web4application On Fri, 12 Jun 2026 at 9:07 AM <aur-dev-request@lists.archlinux.org> wrote:
Send Aur-dev mailing list submissions to aur-dev@lists.archlinux.org
To subscribe or unsubscribe via email, send a message with subject or body 'help' to aur-dev-request@lists.archlinux.org
You can reach the person managing the list at aur-dev-owner@lists.archlinux.org
When replying, please edit your Subject line so it is more specific than "Re: Contents of Aur-dev digest..."Today's Topics:
1. Fwd: AUR Ownership Notification for android-support-repository (Sasha Moak) 2. Re: Fwd: AUR Ownership Notification for android-support-repository (Jonathan Grotelüschen)
---------- Forwarded message ---------- From: Sasha Moak <sashamoak@gmail.com> To: aur-dev@lists.archlinux.org Cc: Bcc: Date: Thu, 11 Jun 2026 12:53:15 -0700 Subject: Fwd: AUR Ownership Notification for android-support-repository Hello! I am (or was) the owner of this package ( https://aur.archlinux.org/pkgbase/android-support-repository/).
However, it might have gotten taken over and it's unclear what the new owner is trying to do here...
https://aur.archlinux.org/cgit/aur.git/tree/android-support-repository-deps....
It's definitely suspect as this should not need to install anything from npm. And the new user was recently registered ( 2026-06-11 (UTC)) and is making the same changes to other aur packages:
1. https://aur.archlinux.org/cgit/aur.git/commit/?h=blinkenlib&id=3a4465e6677b1... 2. https://aur.archlinux.org/cgit/aur.git/commit/?h=monochrome&id=ac99c178127f5...
Definitely looking strange to me...
Not sure how the new user took over my package though? I thought I'd at least have the ability to approve/deny?
Just wanted to drop the message here to see if there's a way to either delete the package entirely or remove the user? And to look into whatever it is they're doing?
Best,
Sasha Moak
---------- Forwarded message --------- From: <notify@aur.archlinux.org> Date: Thu, Jun 11, 2026 at 10:13 AM Subject: AUR Ownership Notification for android-support-repository To: <sasha.moak@gmail.com>
The package android-support-repository [1] was adopted by huldaschurch [2].
[1] https://aur.archlinux.org/pkgbase/android-support-repository/ [2] https://aur.archlinux.org/account/huldaschurch/
---------- Forwarded message ---------- From: "Jonathan Grotelüschen" <tippfehlr@archlinux.org> To: aur-dev@lists.archlinux.org, sashamoak@gmail.com Cc: Bcc: Date: Thu, 11 Jun 2026 23:54:35 +0200 Subject: Re: Fwd: AUR Ownership Notification for android-support-repository On 2026-06-11 21:53, Sasha Moak wrote:
Hello! I am (or was) the owner of this package (https:// aur.archlinux.org/pkgbase/android-support-repository/ <https:// aur.archlinux.org/pkgbase/android-support-repository/>).
Hi Sasha!
However, it might have gotten taken over and it's unclear what the new owner is trying to do here...
https://aur.archlinux.org/cgit/aur.git/tree/android-support-repository- deps.install?h=android-support- repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc <https:// aur.archlinux.org/cgit/aur.git/tree/android-support-repository- deps.install?h=android-support- repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc>
I already deleted the malicious commit and banned the account, and now also disowned the package so you can adopt it again.
It's definitely suspect as this should not need to install anything from npm. And the new user was recently registered ( 2026-06-11 (UTC)) and is making the same changes to other aur packages:
1. https://aur.archlinux.org/cgit/aur.git/commit/? h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd <https:// aur.archlinux.org/cgit/aur.git/commit/? h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd> 2. https://aur.archlinux.org/cgit/aur.git/commit/? h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7 <https:// aur.archlinux.org/cgit/aur.git/commit/? h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7>
Definitely looking strange to me...
Not sure how the new user took over my package though? I thought I'd at least have the ability to approve/deny?
My guess is that you disowned the package when declaring the package as deprecated. That would match the notification email.
Just wanted to drop the message here to see if there's a way to either delete the package entirely or remove the user? And to look into whatever it is they're doing?
Best,
Sasha Moak
Best, Jonathan _______________________________________________ Aur-dev mailing list -- aur-dev@lists.archlinux.org To unsubscribe send an email to aur-dev-leave@lists.archlinux.org
participants (1)
-
Web4app