June 2026 - Aur-general - lists.archlinux.org

Malicious commits: pypiserver, anythingllm-cli-bin, python-dbapi-compliance
by Ilaï Deutel 11 Jun '26

11 Jun '26

Hello, Commits from new AUR user meryemplath seem to be malicious. I disowned the pypiserver package yesterday. meryemplath took ownership today and immediately pushed a commit impersonating me, adding a malicious post-install script. It installs atomic-lockfile, a NPM package that executes a binary blob as post-install script. There is no reason NPM should be a dependency for pypiserver. I haven't fully analyzed atomic-lockfile's binary blob, but it contains references to private data e.g. .local/share/TelegramDesktop/tdatasnap/telegram-desktop/current/.local/share/TelegramDesktop/tdata, so I'm assuming this is an exfiltration attempt. Affected packages: - pypiserver (previously maintained by me) - python-dbapi-compliance (previously maintained by Felix Yan) - anythingllm-cli-bin (previously maintained by Julian Corbet) Cheers, Ilaï

2 1

Suspicious/malicious activity on rtspeccy-git
by movq 11 Jun '26

11 Jun '26

Hello, someone adopted an old orphaned package of mine and this now installs some NPM packages (atomic-lockfile, chalk, minimist): https://aur.archlinux.org/cgit/aur.git/commit/?h=rtspeccy-git&id=b0e6047648… As I'm the author of the actual software in question (rtspeccy), I can assure you that no NPM package is needed. Also note how they kept using my old real name in the Git commit. Thanks, -movq

2 1

Malicious update to workbench
by Mark Wagie 11 Jun '26

11 Jun '26

A new Maintainer adopted workbench and added an install file with the following: npm install atomic-lockfile dotenv axios https://aur.archlinux.org/cgit/aur.git/commit/?h=workbench&id=5f2ef18983bfc…

1 0

Opinions on my first package?
by Borna Punda 09 Jun '26

09 Jun '26

Greetings, After lurking around for a year, I finally noticed a package I used that wasn't in the AUR so I tried my hand at packaging it. I would love any feedback, especially if I missed any standards. Web: https://aur.archlinux.org/packages/coderabbit Clone: https://aur.archlinux.org/coderabbit.git Sorry if this doesn't belong in this list. Best regards, -- Borna Punda

3 6

browsh-bin sketchy NPM install
by Tom Buckley-Houston 08 Jun '26

08 Jun '26

Hello, I'm the creator of Browsh, but not the owner of the AUR browsh-bin package. I've just registered for this mailing list after somebody mentioned that browsh-bin has started installing a sketchy NPM package. I don't see where this change could have happened based on the logs here https://aur.archlinux.org/cgit/aur.git/log/?h=browsh-bin Perhaps I'm missing something. Thanks, Tom

3 3

Re: Ideas for moderating malicious AUR packages
by Carson Coder 06 Jun '26

06 Jun '26

Hi, I had an idea. What if we flagged the first 10 commits from a new user for manual review? That way a malicious actor would have to make at least 10 good commits, before making a malicious commit. The main downside I can think about is that this might add a lot more work for the moderators but also it would make making malicious packages harder / take longer. Even then, if someone does make 10 good commits and then makes a malicious commit, they would have at least contributed 10 good commits. Maybe we could even make the number of commits vary from user to user (maybe have some sort of system so someone can't just make 10 commits to change the version of a package) so that its harder to know how many good commits need to be made. (this is my first time mailing this list, if I am being stupid please tell me nicely)

9 10

no new cgterm
by Luna Jernberg 06 Jun '26

06 Jun '26

https://aur.archlinux.org/packages/cgterm#comment-1074228

1 0