I wasn't subbed to the list to get the AUR REPORT THREAD, but here are some more suspicious packages:
All doing the npm shenanigans so definitely sus: https://aur.archlinux.org/packages/android-support-repository https://aur.archlinux.org/packages/monochrome https://aur.archlinux.org/packages/blinkenlib https://aur.archlinux.org/packages/perl-set-object
