Exactly the same behavior here, with the same account registration date, last commiter impersonation, adding a semi-plausible .install file and everything else: https://aur.archlinux.org/packages/neovim-gtk-git
On Fri, 2026-06-12 at 17:46 +0400, Bitals wrote: > Hello everyone, > > Seems like the same thing happened with this one: > <https://aur.archlinux.org/packages/blueprint-compiler-git> > > New account, takeover of an outdated package, just uses bun instead > of npm. Even exploits git's infamous commit authorship system based > on hopes and dreams to mark xiota as an author of the newest one. > > I'm not a(n) (ex) maintainer, just got a notification for this > change. > > On 12 June 2026 01:54:35 GMT+04:00, "Jonathan Grotelüschen" > <[email protected]> wrote: > > On 2026-06-11 21:53, Sasha Moak wrote: > > > Hello! I am (or was) the owner of this package (https:// > > > aur.archlinux.org/pkgbase/android-support-repository/ <https:// > > > aur.archlinux.org/pkgbase/android-support-repository/>). > > > > > > > Hi Sasha! > > > > > However, it might have gotten taken over and it's unclear what > > > the new owner is trying to do here... > > > > > > https://aur.archlinux.org/cgit/aur.git/tree/android-support-repository > > > - deps.install?h=android-support- > > > repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc <https:// > > > aur.archlinux.org/cgit/aur.git/tree/android-support-repository- > > > deps.install?h=android-support- > > > repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc> > > > > I already deleted the malicious commit and banned the account, and > > now also disowned the package so you can adopt it again. > > > > > > > > It's definitely suspect as this should not need to install > > > anything from npm. And the new user was recently registered ( > > > 2026-06-11 (UTC)) and is making the same changes to other aur > > > packages: > > > > > > 1. https://aur.archlinux.org/cgit/aur.git/commit/? > > > h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd > > > <https:// aur.archlinux.org/cgit/aur.git/commit/? > > > h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd> > > > 2. https://aur.archlinux.org/cgit/aur.git/commit/? > > > h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7 > > > <https:// aur.archlinux.org/cgit/aur.git/commit/? > > > h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7> > > > > > > Definitely looking strange to me... > > > > > > Not sure how the new user took over my package though? I thought > > > I'd at least have the ability to approve/deny? > > > > > > > My guess is that you disowned the package when declaring the > > package as deprecated. That would match the notification email. > > > > > Just wanted to drop the message here to see if there's a way to > > > either delete the package entirely or remove the user? And to > > > look into whatever it is they're doing? > > > > > > Best, > > > > > > Sasha Moak > > > > Best, > > Jonathan
