- Aur-general - lists.archlinux.org

AUR REPORT THREAD
by Jonathan Grotelüschen 11 Jun '26

11 Jun '26

Hi everyone, we’re working hard to reset/delete all malicious commits and ban the accounts. If you find more malicious packages, please **send them as a reply to this email** to keep them all in one thread. Thanks! -- tippfehlr

7 41

Malicious update to gnome-randr-rust
by Mark Wagie 11 Jun '26

11 Jun '26

A new Maintainer adopted gnome-randr-rust and added an install file with the following: npm install atomic-lockfile yargs https://aur.archlinux.org/cgit/aur.git/commit/?h=gnome-randr-rust&id=da9f4c…

17 38

Few more malicious packages
by Sasha Moak 11 Jun '26

11 Jun '26

I wasn't subbed to the list to get the AUR REPORT THREAD, but here are some more suspicious packages: All doing the npm shenanigans so definitely sus: https://aur.archlinux.org/packages/android-support-repository https://aur.archlinux.org/packages/monochrome https://aur.archlinux.org/packages/blinkenlib https://aur.archlinux.org/packages/perl-set-object

1 0

Suspicious/malicious update to alvr
by Kusoneko 11 Jun '26

11 Jun '26

Hello, The newest maintainer for the alvr AUR package has made a commit that adds npm packages to what is quite clearly not a npm project. As well as replaced the email addresses of previous maintainers with their own while keeping the same name as the latest committer. More can be seen from the comments of various users since this update has been pushed. https://aur.archlinux.org/cgit/aur.git/tree/alvr- deps.install?h=alvr&id=0a0ba889acbf354b5d912240993bffcb4ca21f29 Package link: https://aur.archlinux.org/packages/alvr New maintainer/malicious user: krisztinavarga Thank you, Kusoneko.

3 2

Malicious users franziskaweber tobiaswesterburg ellenmyklebust
by Fabio Loli 11 Jun '26

11 Jun '26

Hi all, I've checked the updates notification so far, these are all malicious https://aur.archlinux.org/packages?K=franziskaweber&SeB=m https://aur.archlinux.org/packages?K=tobiaswesterburg&SeB=m https://aur.archlinux.org/packages?K=ellenmyklebust&SeB=m

1 0

Re: Reply to topic: 'multiple malicious AUR updates'
by Mark Wagie 11 Jun '26

11 Jun '26

...and another one gnome-terminal-fedora: https://aur.archlinux.org/cgit/aur.git/commit/?h=gnome-terminal-fedora&id=8…

2 2

Malicious updates zathura-gruvbox-git, python2-mutagen, fastoggenc etc
by Fabio Loli 11 Jun '26

11 Jun '26

2 1

Malicious commits: pypiserver, anythingllm-cli-bin, python-dbapi-compliance
by Ilaï Deutel 11 Jun '26

11 Jun '26

Hello, Commits from new AUR user meryemplath seem to be malicious. I disowned the pypiserver package yesterday. meryemplath took ownership today and immediately pushed a commit impersonating me, adding a malicious post-install script. It installs atomic-lockfile, a NPM package that executes a binary blob as post-install script. There is no reason NPM should be a dependency for pypiserver. I haven't fully analyzed atomic-lockfile's binary blob, but it contains references to private data e.g. .local/share/TelegramDesktop/tdatasnap/telegram-desktop/current/.local/share/TelegramDesktop/tdata, so I'm assuming this is an exfiltration attempt. Affected packages: - pypiserver (previously maintained by me) - python-dbapi-compliance (previously maintained by Felix Yan) - anythingllm-cli-bin (previously maintained by Julian Corbet) Cheers, Ilaï

2 1

Suspicious/malicious activity on rtspeccy-git
by movq 11 Jun '26

11 Jun '26

Hello, someone adopted an old orphaned package of mine and this now installs some NPM packages (atomic-lockfile, chalk, minimist): https://aur.archlinux.org/cgit/aur.git/commit/?h=rtspeccy-git&id=b0e6047648… As I'm the author of the actual software in question (rtspeccy), I can assure you that no NPM package is needed. Also note how they kept using my old real name in the Git commit. Thanks, -movq

2 1

Malicious update to workbench
by Mark Wagie 11 Jun '26

11 Jun '26

A new Maintainer adopted workbench and added an install file with the following: npm install atomic-lockfile dotenv axios https://aur.archlinux.org/cgit/aur.git/commit/?h=workbench&id=5f2ef18983bfc…

1 0