Those packages are likely compromised (all from a malicious user
charlottedurand):
python-poetry-plugin-dotenv
iceweasel
firefox-esr-globalmenu
python-pylsp-rope
cardano-node-bin
git-open
nitrogen-git
nem-wallet
minify-js-bin
minichrome
mingw-w64-laz-perf
mdbook-compress
masari
linux-cachyos-deckify-native
linux-cachyos-deckify-native-headers
librewolf-extension-protonpass-bin
librewolf-extension-duckduckgo-privacy-essentials
kristforge-bin
kmorph
just-js-completion
js-design-appimage
js-design-agent-bin
jade-application-kit
gutenpy
gobyte-qt
gminer-bin
fontfinder
firefox-librejs
firefox-floccus
firefox-esr-ublock-origin
firefox-esr-noscript
firefox-babble
fifth-git
felinks-python
ethlint-git
esteem-bin
emerald-wallet-bin
elixirscript
elements-project-bin
elements-project
edfbrowser-git
deno-git
cxo
curecoind-git
ctjs-bin
create-next-app
concordium-node-bin
concordium-desktop-wallet-testnet-bin
concordium-desktop-wallet-bin
concordium-desktop-wallet-appimage
code-notes-bin
cl-javascript
certbox-bin
catalyst5-browser
carto-sql-api
cardano-wallet
cardano-addresses
camunda-modeler-plugin-bpmn-js-token-simulation
caja-deja-dup-bzr
btdex-git
browserpass-git
browserpass-cachy-browser
bonsai-browser
On Sat, Jun 13, 2026, at 21:36, Joshua Arnott wrote:
On Sat, 13 Jun 2026, at 8:31 PM, Edmund Lodewijks wrote:
Hallo!
Reporting AUR package: caja-deja-dup-bzr
Just found this one, a former package of mine that I apparently still
receive updates for:
caja-deja-dup-bzr
Perhaps a script that checks all uploads via SSH / changes on disk, and
flags any addition of 'bun' etc?
Kind regards,
Edmund
--
TZ: UCT+2 / GMT+2
The malicious code in this is lightly obfuscated using string concatenation in the post install hook to avoid basic pattern matching using grep, etc. Is that new?