Confirm suspicion: ALVR doesn't use NPM. Something's clearly fishy. I'm a russian speaking user and "krisztinavarga" sounds like a Russian name, and as Yobson pointed out in the comments section, "PLYSHKA" (thing) is also a russian word. This commit says it all, ALVR doesn't need NPM. https://aur.archlinux.org/cgit/aur.git/tree/alvr-deps.install?h=alvr&id=0a0ba889acbf354b5d912240993bffcb4ca21f29 On Thursday, June 11th, 2026 at 4:20 PM, Kusoneko <[email protected]> wrote:
> Hello, > > The newest maintainer for the alvr AUR package has made a commit that adds > npm packages to what is quite clearly not a npm project. As well as replaced > the email addresses of previous maintainers with their own while keeping the > same name as the latest committer. More can be seen from the comments of > various users since this update has been pushed. > > https://aur.archlinux.org/cgit/aur.git/tree/alvr- > deps.install?h=alvr&id=0a0ba889acbf354b5d912240993bffcb4ca21f29 > > Package link: https://aur.archlinux.org/packages/alvr > New maintainer/malicious user: krisztinavarga > > Thank you, > Kusoneko.
