On 2026-06-11 21:53, Sasha Moak wrote:
Hello! I am (or was) the owner of this package (https:// aur.archlinux.org/pkgbase/android-support-repository/ <https:// aur.archlinux.org/pkgbase/android-support-repository/>).
Hi Sasha!
However, it might have gotten taken over and it's unclear what the new owner is trying to do here...https://aur.archlinux.org/cgit/aur.git/tree/android-support-repository- deps.install?h=android-support- repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc <https:// aur.archlinux.org/cgit/aur.git/tree/android-support-repository- deps.install?h=android-support- repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc>
I already deleted the malicious commit and banned the account, and now also disowned the package so you can adopt it again.
It's definitely suspect as this should not need to install anything from npm. And the new user was recently registered ( 2026-06-11 (UTC)) and is making the same changes to other aur packages:1. https://aur.archlinux.org/cgit/aur.git/commit/? h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd <https:// aur.archlinux.org/cgit/aur.git/commit/? h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd> 2. https://aur.archlinux.org/cgit/aur.git/commit/? h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7 <https:// aur.archlinux.org/cgit/aur.git/commit/? h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7>Definitely looking strange to me...Not sure how the new user took over my package though? I thought I'd at least have the ability to approve/deny?
My guess is that you disowned the package when declaring the package as deprecated. That would match the notification email.
Just wanted to drop the message here to see if there's a way to either delete the package entirely or remove the user? And to look into whatever it is they're doing?Best, Sasha Moak
Best, Jonathan
OpenPGP_signature.asc
Description: OpenPGP digital signature
