Fwd: AUR Ownership Notification for android-support-repository
Hello! I am (or was) the owner of this package ( https://aur.archlinux.org/pkgbase/android-support-repository/). However, it might have gotten taken over and it's unclear what the new owner is trying to do here... https://aur.archlinux.org/cgit/aur.git/tree/android-support-repository-deps.... It's definitely suspect as this should not need to install anything from npm. And the new user was recently registered ( 2026-06-11 (UTC)) and is making the same changes to other aur packages: 1. https://aur.archlinux.org/cgit/aur.git/commit/?h=blinkenlib&id=3a4465e6677b1... 2. https://aur.archlinux.org/cgit/aur.git/commit/?h=monochrome&id=ac99c178127f5... Definitely looking strange to me... Not sure how the new user took over my package though? I thought I'd at least have the ability to approve/deny? Just wanted to drop the message here to see if there's a way to either delete the package entirely or remove the user? And to look into whatever it is they're doing? Best, Sasha Moak ---------- Forwarded message --------- From: <notify@aur.archlinux.org> Date: Thu, Jun 11, 2026 at 10:13 AM Subject: AUR Ownership Notification for android-support-repository To: <sasha.moak@gmail.com> The package android-support-repository [1] was adopted by huldaschurch [2]. [1] https://aur.archlinux.org/pkgbase/android-support-repository/ [2] https://aur.archlinux.org/account/huldaschurch/
On 2026-06-11 21:53, Sasha Moak wrote:
Hello! I am (or was) the owner of this package (https:// aur.archlinux.org/pkgbase/android-support-repository/ <https:// aur.archlinux.org/pkgbase/android-support-repository/>).
Hi Sasha!
However, it might have gotten taken over and it's unclear what the new owner is trying to do here...
https://aur.archlinux.org/cgit/aur.git/tree/android-support-repository- deps.install?h=android-support- repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc <https:// aur.archlinux.org/cgit/aur.git/tree/android-support-repository- deps.install?h=android-support- repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc>
I already deleted the malicious commit and banned the account, and now also disowned the package so you can adopt it again.
It's definitely suspect as this should not need to install anything from npm. And the new user was recently registered ( 2026-06-11 (UTC)) and is making the same changes to other aur packages:
1. https://aur.archlinux.org/cgit/aur.git/commit/? h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd <https:// aur.archlinux.org/cgit/aur.git/commit/? h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd> 2. https://aur.archlinux.org/cgit/aur.git/commit/? h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7 <https:// aur.archlinux.org/cgit/aur.git/commit/? h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7>
Definitely looking strange to me...
Not sure how the new user took over my package though? I thought I'd at least have the ability to approve/deny?
My guess is that you disowned the package when declaring the package as deprecated. That would match the notification email.
Just wanted to drop the message here to see if there's a way to either delete the package entirely or remove the user? And to look into whatever it is they're doing?
Best,
Sasha Moak
Best, Jonathan
Hello everyone, Seems like the same thing happened with this one: <https://aur.archlinux.org/packages/blueprint-compiler-git> New account, takeover of an outdated package, just uses bun instead of npm. Even exploits git's infamous commit authorship system based on hopes and dreams to mark xiota as an author of the newest one. I'm not a(n) (ex) maintainer, just got a notification for this change. On 12 June 2026 01:54:35 GMT+04:00, "Jonathan Grotelüschen" <tippfehlr@archlinux.org> wrote:
On 2026-06-11 21:53, Sasha Moak wrote:
Hello! I am (or was) the owner of this package (https:// aur.archlinux.org/pkgbase/android-support-repository/ <https:// aur.archlinux.org/pkgbase/android-support-repository/>).
Hi Sasha!
However, it might have gotten taken over and it's unclear what the new owner is trying to do here...
https://aur.archlinux.org/cgit/aur.git/tree/android-support-repository- deps.install?h=android-support- repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc <https:// aur.archlinux.org/cgit/aur.git/tree/android-support-repository- deps.install?h=android-support- repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc>
I already deleted the malicious commit and banned the account, and now also disowned the package so you can adopt it again.
It's definitely suspect as this should not need to install anything from npm. And the new user was recently registered ( 2026-06-11 (UTC)) and is making the same changes to other aur packages:
1. https://aur.archlinux.org/cgit/aur.git/commit/? h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd <https:// aur.archlinux.org/cgit/aur.git/commit/? h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd> 2. https://aur.archlinux.org/cgit/aur.git/commit/? h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7 <https:// aur.archlinux.org/cgit/aur.git/commit/? h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7>
Definitely looking strange to me...
Not sure how the new user took over my package though? I thought I'd at least have the ability to approve/deny?
My guess is that you disowned the package when declaring the package as deprecated. That would match the notification email.
Just wanted to drop the message here to see if there's a way to either delete the package entirely or remove the user? And to look into whatever it is they're doing?
Best,
Sasha Moak
Best, Jonathan
Exactly the same behavior here, with the same account registration date, last commiter impersonation, adding a semi-plausible .install file and everything else: https://aur.archlinux.org/packages/neovim-gtk-git On Fri, 2026-06-12 at 17:46 +0400, Bitals wrote:
Hello everyone,
Seems like the same thing happened with this one: <https://aur.archlinux.org/packages/blueprint-compiler-git>
New account, takeover of an outdated package, just uses bun instead of npm. Even exploits git's infamous commit authorship system based on hopes and dreams to mark xiota as an author of the newest one.
I'm not a(n) (ex) maintainer, just got a notification for this change.
On 12 June 2026 01:54:35 GMT+04:00, "Jonathan Grotelüschen" <tippfehlr@archlinux.org> wrote:
On 2026-06-11 21:53, Sasha Moak wrote:
Hello! I am (or was) the owner of this package (https:// aur.archlinux.org/pkgbase/android-support-repository/ <https:// aur.archlinux.org/pkgbase/android-support-repository/>).
Hi Sasha!
However, it might have gotten taken over and it's unclear what the new owner is trying to do here...
https://aur.archlinux.org/cgit/aur.git/tree/android-support-repository - deps.install?h=android-support- repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc <https:// aur.archlinux.org/cgit/aur.git/tree/android-support-repository- deps.install?h=android-support- repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc>
I already deleted the malicious commit and banned the account, and now also disowned the package so you can adopt it again.
It's definitely suspect as this should not need to install anything from npm. And the new user was recently registered ( 2026-06-11 (UTC)) and is making the same changes to other aur packages:
1. https://aur.archlinux.org/cgit/aur.git/commit/? h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd <https:// aur.archlinux.org/cgit/aur.git/commit/? h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd> 2. https://aur.archlinux.org/cgit/aur.git/commit/? h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7 <https:// aur.archlinux.org/cgit/aur.git/commit/? h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7>
Definitely looking strange to me...
Not sure how the new user took over my package though? I thought I'd at least have the ability to approve/deny?
My guess is that you disowned the package when declaring the package as deprecated. That would match the notification email.
Just wanted to drop the message here to see if there's a way to either delete the package entirely or remove the user? And to look into whatever it is they're doing?
Best,
Sasha Moak
Best, Jonathan
participants (3)
-
Bitals
-
Jonathan Grotelüschen
-
Sasha Moak