FlyingReisun [1] filed a deletion request for vapoursynth-preview-git [2]: Malicious commit which adds npm as a dependency and tries to install a malicious npm package "atomic-lockfile" which is in the "vapoursynth- preview-git-deps.install" file [1] https://aur.archlinux.org/account/FlyingReisun/ [2] https://aur.archlinux.org/pkgbase/vapoursynth-preview-git/