Thanks to all the moderators for removing them! There remains 1 package still from what I can see tho:
qt-solutions-git apart from that git -G didn't find any other instances of js-digest or lockfile-js. Best, koraynilay On Fri Jun 12, 2026 at 3:03 PM CEST, koraynilay wrote: > welp, running > git log --all --since="10 hours ago" -p -S js-digest --decorate=full | > /bin/grep -Po '(?<=origin/).*(?=\))' > yields ~900 packages[1], quickly skimming through the logs they all seem > to be malicious like the last wave. > > I do see the number decreasing almost each time I run it, but I feel I > should still send the latest list I got. > These are 879 packages. > [...]
signature.asc
Description: PGP signature
