Hi, I also just received a notification that a package I manage has been taken over:
The package tllocalmgr-git [1] was adopted by slavicanaf [2].
[1] https://aur.archlinux.org/pkgbase/tllocalmgr-git/ [2] https://aur.archlinux.org/account/slavicanaf/
So far no commits have been added. Thank you guys for your efforts! Cheers, Hans On 12.06.26 3:29 PM, Jared Sutton wrote:
I got an AUR notification this morning that a package I originally created many years ago had been taken over since it had gone orphaned. I can see from the diff that it's also a victim of the bun attack...
- qscite
Thanks for making a place to report these centrally.
-Jared
On Fri, Jun 12, 2026, 9:26 AM Mario Finelli <mario@finel.li <mailto:mario@finel.li>> wrote:
On 6/11/26 19:47, Jonathan Grotelüschen wrote: > Hi everyone, > > we’re working hard to reset/delete all malicious commits and ban the > accounts. > > If you find more malicious packages, please **send them as a reply to > this email** to keep them all in one thread.
Hi more packages infected with the new bun js-digest attack:
- ruby-oauth - ruby-activerecord - ruby-activemodel - ruby-thread_safe
They all use different AUR accounts which I assume are all malicious as well.
Thanks for cleaning this up!
> > Thanks! > > -- > tippfehlr
Cheers, Mario