Hi Claudia,
On Sunday, October 18th, 2026 at 6:31 PM, Claudia Pellegrino <[email protected]> wrote: > One practical method you can use to detect this pattern: if the > `Maintainer` account has a line that says “Inactive since $DATETIME” > *and* `Last Packager` is an Arch Linux Package Maintainer *and* `Last > Updated` is very close to $DATETIME, then you can be 99 % sure that it’s > a case of a malicious commit that was rewritten and force pushed similar > to how tippfehlr did. > > If the purge was recent and you’d like to see a copy of the purged > commit(s), you can contact the Package Maintainer who is marked `Last > Packager` and ask them to send it to you. Whenever I purge a commit from > the AUR, I usually keep the clone on my computer for at least seven more > days so I can fetch it from the reflog on request if anyone wants to see > it for forensics. The heuristic you describe (Inactive-since ≈ Last Updated, Last Packager = TU) is solid, but today every watcher has to reverse-engineer it from three disconnected fields, and it only works after someone like you has already done the cleanup and remembers it. A first-class mechanism, say, an explicit "security hold" state on a pkgbase, visible in the metadata the way orphan/maintainer already is, would give the same signal without depending on TU memory or on field coincidences that future cleanup styles might not reproduce. Same friction, but declared instead of implied. Worth considering whenever the event-visibility work happens > Thank you for your effort and watchfulness. However, if by “them” you > mean the fennekuiper account, no need to watch that one specifically. > Fennekuiper was suspended indefinitely. On "them": I meant the packages, not the account, the 13 packages stay on my list: a PKGBUILD that was compromised once has a different prior than one that never was, no matter who cleaned it up or who currently holds the maintainer field. That's about the packages' history, not about fennekuiper. The "list" I'm referencing is a kind of preemptive-IOC I'm implementing in https://github.com/emiliano-go/trustsight , just in case. Better safe than sorry :D. Thanks for your response. Bests, Emiliano > Emiliano Gandini Outeda > emiliano-go[dot]com > emiliano.gandini[at]protonmail[dot]com
publickey - [email protected] - 0xF759D6D4.asc
Description: application/pgp-keys
signature.asc
Description: OpenPGP digital signature
