Can confirm. These were detected by my watcher container, I was asleep and missed it, see below.
The rules triggered are defined in https://github.com/emiliano-go/trustsight, just as a reference. Ntfy log from the watcher at 10/13/26, 9:34 PM (7 min after upload): {"event": "trustsight.alerts", "tool": "trustsight", "title": "TrustSight: 1 campaign cluster(s), 45 new alert(s)", "priority": "default", "cycle": {"added": 15, "changed": 13, "removed": 0, "processed": 28}, "alerts": [{"package": "ay", "rule_id": "H045"}, {"package": "ayy", "rule_id": "H045"}, {"package": "hay", "rule_id": "H045"}, {"package": "tay", "rule_id": "H045"}, {"package": "uay", "rule_id": "H045"}, {"package": "ya", "rule_id": "H045"}, {"package": "yaay", "rule_id": "H045"}, {"package": "yat", "rule_id": "H045"}, {"package": "yau", "rule_id": "H045"}, {"package": "yayy", "rule_id": "H045"}, {"package": "yqy", "rule_id": "H045"}, {"package": "ysy", "rule_id": "H045"}, {"package": "yya", "rule_id": "H045"}, {"package": "yyay", "rule_id": "H045"}, {"package": "yzy", "rule_id": "H045"}, {"package": "ay", "rule_id": "H052"}, {"package": "ayy", "rule_id": "H052"}, {"package": "hay", "rule_id": "H052"}, {"package": "tay", "rule_id": "H052"}, {"package": "uay", "rule_id": "H052"}, {"package": "ya", "rule_id": "H052"}, {"package": "yaay", "rule_id": "H052"}, {"package": "yat", "rule_id": "H052"}, {"package": "yau", "rule_id": "H052"}, {"package": "yayy", "rule_id": "H052"}, {"package": "yqy", "rule_id": "H052"}, {"package": "ysy", "rule_id": "H052"}, {"package": "yya", "rule_id": "H052"}, {"package": "yyay", "rule_id": "H052"}, {"package": "yzy", "rule_id": "H052"}, {"package": "ay", "rule_id": "G003"}, {"package": "ayy", "rule_id": "G003"}, {"package": "hay", "rule_id": "G003"}, {"package": "tay", "rule_id": "G003"}, {"package": "uay", "rule_id": "G003"}, {"package": "ya", "rule_id": "G003"}, {"package": "yaay", "rule_id": "G003"}, {"package": "yat", "rule_id": "G003"}, {"package": "yau", "rule_id": "G003"}, {"package": "yayy", "rule_id": "G003"}, {"package": "yqy", "rule_id": "G003"}, {"package": "ysy", "rule_id": "G003"}, {"package": "yya", "rule_id": "G003"}, {"package": "yyay", "rule_id": "G003"}, {"package": "yzy", "rule_id": "G003"}], "over_threshold": [], "ioc_matches": [], "campaign_cluster": [{"rule_id": "G003", "members": ["ay", "ayy", "hay", "tay", "uay", "ya", "yaay", "yat", "yau", "yayy", "yqy", "ysy", "yya", "yyay", "yzy"], "count": 15}]} https://ntfy.sh/trustsight-aur-1d8a3fd2 also shows the removal. > Emiliano Gandini Outeda > emiliano-go[dot]com > emiliano.gandini[at]protonmail[dot]com Sent with Proton Mail secure email. On Tuesday, October 13th, 2026 at 11:51 PM, James Smith <[email protected]> wrote: > the user marchos1as[1] typo squated popular packages eg yay/paru > > > [1] https://aur.archlinux.org/packages?K=marchos1as&SeB=m >
publickey - [email protected] - 0xF759D6D4.asc
Description: application/pgp-keys
signature.asc
Description: OpenPGP digital signature
