Hi Fabio,

pkgbuild plex-media-player have been updated to include: […]

Duplicates uploaded today always by new suspicious accounts are:

plex-media-player-v2 plex-media-player-mod plex-media-player-custom

also have 'npm install crypto-javascript' in .install file Thanks for the report! I can confirm that the NPM package delivered by the install script contains malware in its preinstall binary. [1]

I have deleted the three new packages and cleaned up the malicious commit on plex-media-player via force push. The accounts responsible for the malicious commits have been suspended. I have also reported the infected package on NPM. Thanks again for your help. Much appreciated! [1]: https://socket.dev/npm/package/crypto-javascript/overview/4.3.6 Regards Claudia

On 5/28/26 7:28 AM, Fabio Loli wrote:

Il 27/05/26 21:31, Claudia Pellegrino ha scritto:

...

Hi Fabio,

...

pkgbuild plex-media-player have been updated to include: […]

Duplicates uploaded today always by new suspicious accounts are:

plex-media-player-v2 plex-media-player-mod plex-media-player-custom

also have 'npm install crypto-javascript' in .install file Thanks for the report! I can confirm that the NPM package delivered by the install script contains malware in its preinstall binary. [1]

I have deleted the three new packages and cleaned up the malicious commit on plex-media-player via force push. The accounts responsible for the malicious commits have been suspended. I have also reported the infected package on NPM.

Thanks again for your help. Much appreciated!

[1]: https://socket.dev/npm/package/crypto-javascript/overview/4.3.6

Regards Claudia

Thnaks for your work

The malicious account on plex-media-player (abrahamhigueras) and swift-language (klarapavlikova) still own the pkgbuild are active for what I can see

Hey, Both of these accounts have been banned yesterday. The PKGBUILDs will be orphaned when someone fills an orphan request and shows interest to pick them up. Force disowning them immediately is a risk that they get instantly re-adopted by a malicious account. -- Regards, Robin Candau / Antiz

On 7/31/26 7:49 PM, Fabio Loli wrote:

Il 28/05/26 07:41, Robin Candau ha scritto:

...

On 5/28/26 7:28 AM, Fabio Loli wrote:

...

Il 27/05/26 21:31, Claudia Pellegrino ha scritto:

...

Hi Fabio,

...

pkgbuild plex-media-player have been updated to include: […]

Duplicates uploaded today always by new suspicious accounts are:

plex-media-player-v2 plex-media-player-mod plex-media-player-custom

also have 'npm install crypto-javascript' in .install file Thanks for the report! I can confirm that the NPM package delivered by the install script contains malware in its preinstall binary. [1]

I have deleted the three new packages and cleaned up the malicious commit on plex-media-player via force push. The accounts responsible for the malicious commits have been suspended. I have also reported the infected package on NPM.

Thanks again for your help. Much appreciated!

[1]: https://socket.dev/npm/package/crypto-javascript/overview/4.3.6

Regards Claudia

Thnaks for your work

The malicious account on plex-media-player (abrahamhigueras) and swift-language (klarapavlikova) still own the pkgbuild are active for what I can see

Hey,

Both of these accounts have been banned yesterday. The PKGBUILDs will be orphaned when someone fills an orphan request and shows interest to pick them up. Force disowning them immediately is a risk that they get instantly re-adopted by a malicious account.

Malicious user abrahamhigueras of plex-media-player is still not banned

It is, it just wasn't additionally set as "inactive" (which is two different things). I just did set it as inactive. -- Regards, Robin Candau / Antiz