welp, running git log --all --since="10 hours ago" -p -S js-digest --decorate=full | /bin/grep -Po '(?<=origin/).*(?=\))' yields ~900 packages[1], quickly skimming through the logs they all seem to be malicious like the last wave. I do see the number decreasing almost each time I run it, but I feel I should still send the latest list I got. These are 879 packages. [1]: mkdocs-bootswatch mygnuhealth mono-addins-git mojave-ct-icon-theme lab-bin menu-cache-git minder-git mingw-w64-libtheora mbm-gpsd-pl4nkton-git meliora-openbox-themes mapcrafter-git linux-rc lzham lynis-git lyvi-git lxqt-qt5ct libevdevc libhugetlbfs linphone-desktop-all-git lrexlib-pcre5.1 luazip5.1 lwan-git lorem-ipsum-generator libretro-mednafen-supergrafx-git lbench libmrss lib32-gnome-themes-extra libdill libtcd linphone-desktop-all lib32-graphene libnxml librep-git lib32-mtdev libnbcompat libcompizconfig-git icdiff-git kompare-git lexmark_pro700 legofy-git kvirc-git kwin-effects-blur-respect-rounded-decorations-git ha-pacemaker-git joymouse kapacitor joycon-git keepassx2 haunt jdk11-openj9-bin irssistats infinity-background inkslides-git ifcopenshell-git igdm howm-x11-git hpgcc htdig hop ibc homeassistant-osagent garmindev gtk-theme-metagrip gnome-shell-extension-x11gestures gogs-git haskell-chart haxe-git gnome-shell-extension-transmission-daemon-git goqat gpicsync halberd gnome-shell-theme-arc-clearly-dark-git gnome-battery-bench-git gmt-cpt-city freeter fwlogwatch git-remote-hg-git getlive dot-git fuel eslint-plugin-react evilvte-git emacs-d-mode emacs-ess-git exiftags eel-language dub-git dsdcc-git eclipse-markdown compiz-fusion-plugins-extra-git denaro dibuja dkopp docker-gc-git dptf daggerfall-addons dalbum complexity deepin-mail-bin cutemarked-git coppeliasim-bin cpu-monitor-extension-lxpanel-plugin bcalc cross-mingw-w64-gdb craftbukkit-plugin-worldedit codeclimate centerim5-git cjs-git compizconfig-python-git contemporary-cursors cnijfilter-common-mg5400 cardano-node cint cavestory+-hb blogc zenphoto brother-hl3150cdw camotics backwild brother-hll6200dw beets-copyartifacts-git blueprint-compiler-git backup2l avarice-git amdgpu-fancontrol-git auryo avra alfont ar-smileys adom-noteye tsocks-tools vdrift vertx wunderline video-contact-sheet tasmotizer-git udfclient toontown-rewritten syslog-notify tnote rkward-git softethervpn-client-manager staden-io_lib sonixd splashtop-business stencyl sex sixfireusb-dkms snapd-git ros2-arch-deps python2-cffi python-miio scangearmp-mg3500series radare2-bindings-git refind-theme-dreary-git ruby-pusher-client sbt-extras-git rke rdm-bin r8101-dkms pyload-ng python2-ctypes python2-gobject planck qtvkbd python-autopep8-git python-quamash-git python2-cssselect python-avalon_framework python-stagger-git python2-chardet pyrescene-git pbincli python-isounidecode pidgin-cmds pidgin-im-gnome-shell-extension pinegrow perl-datetime-format-sqlite pmus-git opennebula perl-graph pcb2gcode pdf4qt-git perl-lyrics-fetcher openxray otcl pantum-driver openms openav-sorcer-git papirus-maia-icon-theme-git neochat-git ohcount notify-desktop-git open-hexagon-git opendrop mingw-w64-gtk2 nautilus-mediainfo ncursesfm-git necpp-git neuron-zettelkasten-bin nodejs-ionic mongo-cxx-driver-legacy-0.0-26compat multiwinia networkmanager-dispatcher-pdnsd montecarlo-font mingw-w64-adwaita-icon-theme lure mingw-w64-sdl2_ttf libkarma lua51-sql-sqlite luksipc-git mc-skin-modarin-debian hifive1-sdk-git maxima-git wcalc libretro-mame-git lttng-modules libopenaptx-git libdivecomputer-git itop lash lib32-libreplaygain harminv lib32-gimp kopano-core hdx-512-git homeassistant-supervised ibus-uniemoji-git hypr-git kwplayer haskell-asn1-data gtksetpwc haskell-failure fuego-svn glosstex gridmgr-git gnome-specimen globalprotect-bin gnome-rdp gnome-pass-search-provider-git gnome-directory-thumbnailer g2 fontweak gemistdownloader gkraken fstar-git fanicontrol firebird compiz-fusion-plugins-experimental-git fs2_open-mediavps fusion-icon-git fspy flatcam-git evopedia-git energyplus etmtk emacs-jabber-git emacs-magit droopy-git c++-gtk-utils-gtk2 echinus-git emacs-identica-mode autolatex chisel dbxcli emacs-find-recursive edx-downloader-git e4rat-lite-git daala-git bsnes-plus-git cgvg bazel-buildtools capture ccsm-gtk3 astah-uml avogadro2-git organize-bin arduino-git barrier-git bcnc bleufear-gtk-theme android-backup-extractor atlassian-plugin-sdk archivemail alienfx-lite antileech arcadia vectr urjtag-git whitebox zenmonitor zrythm-git alternating-layouts-git amdguid-wayland-bin wxbase zenbound2 writefull-bin vtigercrm xapian-omega xf86-input-cmt tup-git x2vnc-no-xinerama t4kcommon vim-live-latex-preview upower-nocritical tomighty tuxboot-git torch7-image-git ttf-lcsmith-typewriter textsuggest-git thinkwatt samba-mounter-git taskunifier telepresence termbox-git rhythmbox-llyrics taipan sundtek sequencer64-git ruby-mpd soxt snis-git soldat-git squirrelmail r2-iaito-git scavenger raccoon-git ruby-haste rgain3 pygist-git python-kiss-headers qscite qt-inspector-git quickrdp qutepart-git qv2ray-git phpredis-git pnmixer-gtk3 qrfcview perl-test-corpus-audio-mpd python-dugong python-single-version pulseaudio-dlna-cygn pgpool-ii plex-trakt-scrobbler plasma5-wallpapers-video-git perl-text-aspell petri-foo otf-inconsolata-g-powerline-git panopticon-git mesecons-git ocaml-typerex peepdf perl-lwp-protocol-http10 nikola-git pantheon-print-git perl-io-capture open-axiom ndyndns mythes-cs linux-xanmod-rog mikidown-git neuropolitical-ttf leocad-git mingw-w64-libidn mmc-utils-git mp3guessenc markmywords-git mictray mingw-w64-libcroco marcfs-git latex-make lib32-libfmod linkerd lilypond-git libntru libuiohook libgtkhtml libpurple-carbons-git libarcus-git fifth gcstar-gitlab gahshomar galaxy2 ft232r_prog gnome-shell-extension-cpufreq-git fbff-git g3data eperiodique flowblade-git emacs-color-theme elm-format-bin dynamodb chexquest3-wad xorg-xinit-git aksusbd yafaray-git z-push zephyr xsp vdirsyncer-git tvnamer urho3d wiringpi-git watsup xorg-transset urbanbrawl-wad signald powwow run-mailcap ratox-git skanlite-git python-epc shellcheck-git rock ruby-parslet-1.5 sheeplifter pypi-cli sawfish-git sdformat roccat-dkms ruby-actionview ruby-sprockets-rails rtbth-dkms retrovol qinfo ruby-oauth rkflashtool opencorsairlink-git pymedusa remotemouse rbutil-git pg2ipset-git php-blackfire plymouth-theme-asphyxia-git picpuz oh-my-git pidgin-nudge-svn nodejs-elm nwchem ocaml-lambda-term ovras perl-gtk2-ex-podviewer nemerle nixnote2 krakatau-git jstock intelmetool-git clamfs libprelude lastfmlib hydrapaper-git ikos keeperrl-git kalu-git gle-graphics gtk-vnc-gtk2 hexchat-otr darwinia guile-ssh gnome-shell-extension-dynamic-top-bar huawei-stat-e220 distrho-ports-lv2-git gcal fs2-knossos emacs-mew cccc fengoffice cpuset desktopnova exact-image createvm bdf-creep codeigniter connman-ncurses aws-cli-git asciiworld-git biosdevname aquaria-ose balena-cli binnavi arachnophilia beancount-git zxtune-git beef awoken-icons stable-diffusion-webui-git xevdevserver slim-unicode wmtop vim-pandoc-syntax-git sqliteman wally qbittorrent-enhanced-qt5 vim-omlet tweeny vim-delimitmate vim-hexman wings2 veracrypt-git socnetv tcpstat trace-cmd-git undistract-me-git salt-git poldi sachesi-bin samsungctl satanic-icon-themes scanssh rstudio-server-git ruby-blankslate-2 pb-for-desktop raceintospace pluma-plugins qemacs perl-css oxefmsynth otf-sauce-code-powerline-git ocaml-sexplib mato-icons-git miro-video-converter nodejs-forever ohcount-git libwapcaplet-git lib32-libmad mkgmap-svn linvst libpuzzle libspatialindex-git lightdm-webkit-theme-userdock katrain libcss-git fcitx-baidupinyin kicad-library-ab2-git libfprint-vfs_proprietary-git amtterm kwin-scripts-quarter-tiling-git ja2-stracciatella-git eclipse-i18n-de gog-the-witcher-2-assassins-of-kings gavrasm fisher-git gcstar gnome-usage-git bicon-git gcccpuopt fpp-git ffdiaporama-texturemate curseradio-git dianara envoy-git emacs-yasnippet-git coyim drm_tools fantom bracket controllermap emms-git xosview blackfire-agent ascii-rain-git antichamber zelda-roth-se zafiro-icon-theme wavbreaker xarchiver-assume-name ruby-libvirt wds xfce-theme-bluebird ttf-impallari-dosis ttcp tbsecp3-driver-git-dkms vim-fortran vim-molokai-git perl-gtk2-gladexml-simple pdi-ce tracks streetsofrageremake sonar-icon-theme shellinabox-git pacgem scm qpitch ruby-rubysdl osvr-libfunctionality-git scallion qemu-android-x86 papirus-color-scheme pk2cmd-plus octave-hg mon2cam-git nheqminer-cuda-git nodejs-jsdoc mobac-svn mingw-w64-sdl mirrorlist-rankmirrors-hook milena-data milton-git echo-icon-theme-git digikam-without-akonadi evilwm drascula emacs-sml-mode gecode dfhack-bin doom3-inhell dashcore cryptowatch-desktop-bin cwiid xforms containerd-git cb2bib cnijfilter-mp550 colorsvn akira-git akonadi-git alttab-git boostnote-bin cattle numix-themes-green toybox wesnoth-git vim-perl-support wemux-git silver-searcher-git uni2ascii tbs-dvb-drivers olivia-git resetmsmice openpyn-nordvpn ppcoin-qt qshntoolsplit gsettings-desktop-schemas-git mysqltuner-git openhab3 mxnet linux-manjaro-xanmod koules lv kapidox-git libkomparediff2-git kokua-secondlife i3-gnome-git guake-colors-solarized-git zdoom-git sddm-stellar-theme truestudio apwal sunclock audible-activator-git awesome-cinnamon asus-fan-dkms-git android-google-play-apk-expansion ttf-roboto-fontconfig vim-manpageview structuresynth udev-browse-git thunderbird-sieve sickrage-git libpurple-lurch-git rep-gtk ruby-colored geforcenow-electron nixnote2-git rarian joxi marytts kdevelop-pg-qt-git kimageformats-git audiotube-git jdk8-graalvm-bin gnome-shell-extension-hibernate-status-git smartsim-git autozen rtf2latex2e vuze-extreme-mod amide zenpower-dkms phpdocumentor2 weex pgcli-git orientdb-community pkgdistcache qt-solutions-git realtimeconfigquickscan-git pyxplot cpuminer-multi-git limesuite-git msieve cpp-netlib gtk-theme-windows10-dark nip2 brightness-controller-git neovim-gtk-git nodejs-how2 num-utils guile-git libviper gfxbench dvbcut geekcode git-flow-completion-git cvs2svn eclipse-checkstyle caelum castawesome atlassian-confluence adsuck fbctrl arch-palemoon-search cmake-modules-webos-git mesos libptp2 make-3.81 minecraft-overviewer gisto lib32-freeimage borg-git img2djvu-git i3lock-fancy-dualmonitors-git filebot47 flow delaycut nautilus-folder-icons minecraft-overviewer-git psi-plus-resources-git pmount-safe-removal python-pydns numix-themes-electric ms-office-online pdf2book oclint lib32-fftw hattrick_organizer libreoffice-extension-coooder mac-os-lion-cursors libxaw3dxft sfarkxtc yokadi gpshell acpitool chez-scheme-git saleae-logic-beta xf86-input-wizardpen ruby-pygments.rb shadow-tech sublime-music vim-pathogen-git rtags rolo ruby-classifier ruby-execjs gimp-plugin-arrow owncloud-client-git python-gmpy emacs-paredit netmenu java-berkeleydb kodi-addon-inputstream-adaptive-git gmt-coast cerebro elm-platform davtools code-git ttf-dejavu-emojiless xcursor-gt3 vnote vim-lighttpd violetland-git ttf-consolas-powerline cppreference-devhelp networkmanager-ssh-git lib32-libxxf86dga doomsday coffeescript-git drbl-experimental vuze-plugin-mldht argouml ccminer-git cdo ruby-travis transmission-gtk-git vlc-arc-dark-git ttf-essays webui-aria2-git rodentbane-git skdet tora sword-svn statusnotifier openstego j4-make-config-git numix-gtk-theme isight-firmware-tools openhab2 gist-git vte-legacy vinetto bibtex2html qwt-qt4 libsmi ruby-sprockets quack latex-mk mopidy-youtube httpry nordnm pencil-android-lollipop-stencils-git glsl-debugger-git osmose apache-ant-contrib evopop-gtk-theme multimon-ng-git firmware-mod-kit wechat-devtools qeven ruby-railties gitso non-daw-git texlive-moderncv-git rainbarf-git k4dirstat linux_logo_archcustom liri-shell-git menumaker-compiz dmg2dir pytomtom ruby-actionmailer ruby-commander bbswitch-git adapta-gtk-theme-git nikki rhythmbox-plugin-alternative-toolbar-git jin mingw-w64-pcre eviacam kubo-git tiemu ffmpeg3.4 openmsx-catapult linux-steam-integration ruby-activerecord connman-ui-git ruby-activemodel psi-plus-plugins-git n-ninja toggldesktop-bin mopidy-moped inform7 vim-clang-complete-git movgrab terminusmod mime-archpkg qucs java-flexdock purple-facebook-git pantheon-applications-menu-git flv2x264 gr-osmosdr-git lib32-tk gnome-shell-extension-topicons-plus gopenvpn-git coolreader3-git sidplay2-libs ttf-dejavu-sans-mono-powerline-git etherpad-lite libisl15 phonon-qt4 chipmunk ruby-thread_safe jreen-git octave-miscellaneous lib32-libxpm machinarium pcsxr-git zeroinstall-injector fusion-icon shifty-git nodejs-webpack On Fri Jun 12, 2026 at 1:46 PM CEST, a821 wrote:
On Thu, Jun 11, 2026 at 07:47:05PM +0200, Jonathan Grotelüschen wrote:
Hi everyone,
we’re working hard to reset/delete all malicious commits and ban the accounts.
If you find more malicious packages, please **send them as a reply to this email** to keep them all in one thread.
There's another attack currently ongoing it seems. Some users have already requested deletion for them
These packages attempt to install the npm package 'js-digest' which is flagged as malicious [1].
# run from Github's AUR mirror $ git log --all -S js-digest --oneline
224a6d4b0a5d (atomicwalllet) Update dependencies 4191bf8baa5c (atomicwalet) sync (atomicwalet) 63e19a12fc27 (exodas) Fix source 27d23d8fcb8b (exoduz) upgpkg ef470996b936 (exodys) Add missing deps (exodys) 064cfe60c7be (exodis) updpkgsums bb93e7f2ac6a (exodud) Bump pkgrel 946a5ba56245 (exouds) rebuild bd1b18f058f6 (exodux) add deps (exodux) 0c97f4f83a95 (exoduss) Add missing deps