12 Jun
2026
12 Jun
'26
4:35 p.m.
Thanks to all the moderators for removing them! There remains 1 package still from what I can see tho: qt-solutions-git apart from that git -G didn't find any other instances of js-digest or lockfile-js. Best, koraynilay On Fri Jun 12, 2026 at 3:03 PM CEST, koraynilay wrote:
welp, running git log --all --since="10 hours ago" -p -S js-digest --decorate=full | /bin/grep -Po '(?<=origin/).*(?=\))' yields ~900 packages[1], quickly skimming through the logs they all seem to be malicious like the last wave.
I do see the number decreasing almost each time I run it, but I feel I should still send the latest list I got. These are 879 packages. [...]