I found another AUR package that is infected it uses "npm install atomic-lockfile", also the package is 4 hours young. (first commit) https://aur.archlinux.org/cgit/aur.git/commit/?h=exodus-wallet-bin&id=d5b08e... exodus-wallet-bin On Thu, Jun 11, 2026 at 9:17 PM Rafał Lichwała <rafal@siliconet.pl> wrote:
apm_planner-bin
https://aur.archlinux.org/cgit/aur.git/commit/?h=apm_planner-bin&id=b569c6a6...
cmuclmtk
https://aur.archlinux.org/cgit/aur.git/commit/?h=cmuclmtk&id=cb8ca0793547ccb...
anythingllm-appimage
https://aur.archlinux.org/cgit/aur.git/commit/?h=anythingllm-appimage&id=3a9...
On 6/11/26 19:47, Jonathan Grotelüschen wrote:
Hi everyone,
we’re working hard to reset/delete all malicious commits and ban the accounts.
If you find more malicious packages, please **send them as a reply to this email** to keep them all in one thread.
Thanks!
-- tippfehlr