Thanks Saren and goeb for the heads up! Both packages have been reverted to the last known good version.The account who pushed the malicious uploads has been suspended and removed from the list of PKGBUILD co-maintainers.
Regards Claudia On 23.08.26 11:15 PM, goeb wrote:
On 2026-08-23 22:40, Saren wrote:It downloads a lil executable called "systemmanager" from tor. I did not need to analyze the binary or script to know this is malicious. https://aur.archlinux.org/cgit/aur.git/tree/.xsnow.install?h=xsnowhttps://aur.archlinux.org/cgit/aur.git/tree/.xsnow-bin.install? h=xsnow-binThis install script also tries to spread to other AUR repos if run by a maintainer. Might be a good idea to check for any .<package>.install files across the AUR.
OpenPGP_0xD11E9FC4F7C9DA3C.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
