Re: Malicious update to gnome-randr-rust

[Jonathan Grotelüschen]

On 2026-06-11 18:13, Matthias Kurz wrote:

One more: https://aur.archlinux.org/cgit/aur.git/log/?h=python-rembg <https://aur.archlinux.org/cgit/aur.git/log/?h=python-rembg>

On Thu, 11 Jun 2026 at 18:12, DodoGTA GT <aidas...@gmail.com <mailto:aidas...@gmail.com>> wrote:

    On Thu, Jun 11, 2026 at 6:52 PM Lex Black <autumn-w...@web.de
    <mailto:autumn-w...@web.de>> wrote:
     >
     > Am 11. Juni 2026 17:48:18 MESZ schrieb Lex Black <autumn-
    w...@web.de <mailto:autumn-w...@web.de>>:
     > >Am 11. Juni 2026 17:39:33 MESZ schrieb Lex Black <autumn-
    w...@web.de <mailto:autumn-w...@web.de>>:
     > >>Hi,
     > >>Also taken over:
     > >>nextcloud-git
     > >>nextcloud-app-integration-google
     > >>nextcloud-app-repod
     > >>nextcloud-app-facerecognition
     > >>nextcloud-app-audioplayer
     > >>nextcloud-app-twofactor-gateway
     > >>Python-django-modelcluster
     > >>
     > >>Best regards
     > >
     > >Oh, and
     > >nextcloud-app-gpoddersync
     > >
     > >And those were just the ones I got notifications for
     > >
     > >Best regards
     >
     > And the next one
     > python-django-rest-knox carmelobartolome
     > https://aur.archlinux.org/pkgbase/python-django-rest-knox/
    <https://aur.archlinux.org/pkgbase/python-django-rest-knox/>

    python-future, python-tradingeconomics, python-argdispatch, zing-8-bin
    and python-nipype are also affected (and a lot more too)

    Maybe we should emergency auto-reject all packages that add a npm
    dependency for now?

Did all of these, thanks!

OpenPGP_signature.asc
Description: OpenPGP digital signature