Greetings,
I’m on the AUR mailing list and there has been huge influx of packages that were maliciously taken over today. Please check the PKGBUILD and be wary especially of new npm depencencies, particularly one named “atomic-lockfile”, but there might be others.
Thank you for the heads up @jcd. That’s something to keep an eye on.
Yeah, you should always check the pkgnbuild even if updating.
It looks like the pattern is to add an infected package with npm; maybe removing/blacklisting that would be enough for now.
Yeah, it looked like a much smaller amount than what it actually was until recently. I have zero authority of speaking for Arch or the AUR. I just read mails and noticed and thought I tell my endeavourous friends over here.
We need this meme but with “PARU!!!” 
Well I think it is at the least a bit ironic that ARCH warns the user about the AUR and yet sends out messages like this.
Here you can find a list of those mails.
Yeah another reason thy should add some kind of filter to auto scan files that being uploaded and does that are already in AUR and put all findings in a quarantine list for trusted people to review before being allowed in AUR.
Thanks for info.
AUR PKGBUILDs should be treated as potential unexploded bombs 
npm packages should be treated as highly infectious - nuke them from orbit just to be sure 
Yeah, something like that is being discussed, but they also want to avoid multiplying the workload for the current admins/mods. And then there’s the question of who is a trusted user? How does one become a trusted user? BTW some of these packages have been overtaken by accounts using old usernames or realnames of their former owners.
I would prefer not having npm on my system at all. But I didn’t pull through yet.
It seems the AUR is not the only one that has been compromised.
I absolutely refuse to have it on any of my systems 
npm is inherently unsafe
There’s a thread at aur-general to collate all the reports:
Luckily the only thing I had that depends on npm was zed (which I never use). Uninstalled and a dummy npm file placed and chattr +i, so if I miss it it will not install.
