Not exactly malicious, but definitely spam. Using the github AUR repo: In all these cases it adds to bash/zsh etc shell configs to echo spam, in russian, on start.
$ while read ref; do git grep --files-with-matches 'NoServices' $ref; done < <( git refs list --format '%(refname)' ) | grep -Po '(?<=refs\/remotes\/origin\/).*' | sort | tee NoServices.txt algobox alist-desktop-bin arpoison asymptote-git aurbs blackfire-cli ccsm-git chinadns closure-hib cmaptools cypher-shell daggerfall-fixes dbacl docan-bin docan-unstable emacs-evil enyo-launcher esy faudio-git findwild gbdk gnome-pomodoro-git hidapi-git hypatia infer kicadlibrarian libdmx libparserutils-git llama.cpp-sycl-f16-git nikto-git nodejs-serverless nodejs-uglifycss nullfs-dkms-git onivim2-git onvifviewer pcb pcmanx-gtk2-git perl-xml-filter-domfilter-libxml pfqueue pgdbf plasma-theme-helium plataro-icons pngrim-git proteus-hib psychopy purple-gowhatsapp python-cmake-bin python-graphsrv python-imagebackup python-json2html python-llama-cpp-hip python-monkeytype python-pytest-filedata python-tmpl redocly rigsofrods-bin ruby-open_uri_redirections ruby-snapsync samsung-ssd-dc-toolkit scd softmaker-office-2012-bin spacebar-client-git spacebar-git swig2 systemtap-git tapeutape thomaswasalone-hib ttf-dotsies tuwunel-git ultimatevocalremovergui-git vaping vim-railscasts zenta-git (It was always in PKGBUILD, so I removed the ":PKGBUILD" from the output) On Thu, 11 Jun 2026, at 13:47, Jonathan Grotelüschen wrote: > Hi everyone, > > we’re working hard to reset/delete all malicious commits and ban the > accounts. > > If you find more malicious packages, please **send them as a reply to > this email** to keep them all in one thread. > > Thanks! > > -- > tippfehlr > > > *Attachments:* > • OpenPGP_signature.asc
