Hi
`alvr` package got orphaned and instantly picked up by `krisztinavarga` account, that created commit with author impersonation (replaced emails with own on maintainers without changing name + commit with author name as me) and same malware with atomic-lockfile thing in post install steps. Right now I don't see it in commits (reverted?...) Also at around the same time on `alvr-git` I saw change of maintainers, with suspicious email, but I didnt notice it being infected...
