Hello, The newest maintainer for the alvr AUR package has made a commit that adds npm packages to what is quite clearly not a npm project. As well as replaced the email addresses of previous maintainers with their own while keeping the same name as the latest committer. More can be seen from the comments of various users since this update has been pushed. https://aur.archlinux.org/cgit/aur.git/tree/alvr- deps.install?h=alvr&id=0a0ba889acbf354b5d912240993bffcb4ca21f29 Package link: https://aur.archlinux.org/packages/alvr New maintainer/malicious user: krisztinavarga Thank you, Kusoneko.
Confirm suspicion: ALVR doesn't use NPM. Something's clearly fishy. I'm a russian speaking user and "krisztinavarga" sounds like a Russian name, and as Yobson pointed out in the comments section, "PLYSHKA" (thing) is also a russian word. This commit says it all, ALVR doesn't need NPM. https://aur.archlinux.org/cgit/aur.git/tree/alvr-deps.install?h=alvr&id=0a0b... On Thursday, June 11th, 2026 at 4:20 PM, Kusoneko <kusoneko@kusoneko.moe> wrote:
Hello,
The newest maintainer for the alvr AUR package has made a commit that adds npm packages to what is quite clearly not a npm project. As well as replaced the email addresses of previous maintainers with their own while keeping the same name as the latest committer. More can be seen from the comments of various users since this update has been pushed.
https://aur.archlinux.org/cgit/aur.git/tree/alvr- deps.install?h=alvr&id=0a0ba889acbf354b5d912240993bffcb4ca21f29
Package link: https://aur.archlinux.org/packages/alvr New maintainer/malicious user: krisztinavarga
Thank you, Kusoneko.
Its a hungarian name. Ekkor: 2026. június 11. 18:26:11 CEST, nikooneshot.blurb049@silomails.com írta:
Confirm suspicion: ALVR doesn't use NPM. Something's clearly fishy. I'm a russian speaking user and "krisztinavarga" sounds like a Russian name, and as Yobson pointed out in the comments section, "PLYSHKA" (thing) is also a russian word. This commit says it all, ALVR doesn't need NPM. https://aur.archlinux.org/cgit/aur.git/tree/alvr-deps.install?h=alvr&id=0a0b... On Thursday, June 11th, 2026 at 4:20 PM, Kusoneko <kusoneko@kusoneko.moe> wrote:
Hello,
The newest maintainer for the alvr AUR package has made a commit that adds npm packages to what is quite clearly not a npm project. As well as replaced the email addresses of previous maintainers with their own while keeping the same name as the latest committer. More can be seen from the comments of various users since this update has been pushed.
https://aur.archlinux.org/cgit/aur.git/tree/alvr- deps.install?h=alvr&id=0a0ba889acbf354b5d912240993bffcb4ca21f29
Package link: https://aur.archlinux.org/packages/alvr New maintainer/malicious user: krisztinavarga
Thank you, Kusoneko.
can confirm, the name is hungarian. On Thu, 11 Jun 2026 at 21:24, Török Károly <torok.karoly.krisztian@gmail.com> wrote:
Its a hungarian name.
Ekkor: 2026. június 11. 18:26:11 CEST, nikooneshot.blurb049@silomails.com írta:
Confirm suspicion: ALVR doesn't use NPM. Something's clearly fishy. I'm a russian speaking user and "krisztinavarga" sounds like a Russian name, and as Yobson pointed out in the comments section, "PLYSHKA" (thing) is also a russian word. This commit says it all, ALVR doesn't need NPM.
https://aur.archlinux.org/cgit/aur.git/tree/alvr-deps.install?h=alvr&id=0a0b... On Thursday, June 11th, 2026 at 4:20 PM, Kusoneko <kusoneko@kusoneko.moe> wrote:
Hello,
The newest maintainer for the alvr AUR package has made a commit that adds npm packages to what is quite clearly not a npm project. As well as replaced the email addresses of previous maintainers with their own while keeping the same name as the latest committer. More can be seen from the comments of various users since this update has been pushed.
https://aur.archlinux.org/cgit/aur.git/tree/alvr- deps.install?h=alvr&id=0a0ba889acbf354b5d912240993bffcb4ca21f29
Package link: https://aur.archlinux.org/packages/alvr New maintainer/malicious user: krisztinavarga
Thank you, Kusoneko.
participants (4)
-
Kusoneko
-
nikooneshot.blurb049＠silomails.com
-
Shard smp
-
Török Károly