Greetings, I’m on the AUR mailing list and there has been huge influx of packages that were maliciously taken over today. Please check the PKGBUILD and be wary especially of new npm depencencies, particularly one named “atomic-lockfile”, but there might be others.

It looks like the petulant idiots are DDOSing aur again :grimacing:

I can ping it in the terminal but not reach it in the browser.

To be honest, wouldn’t that be a good thing? Nobody would be able to accidentally download a bad package. They are helping us:rofl:

Its reachable in the browser as well now on my end.

can confirm no updating aur packages [image] Post your pacman -Qm Lounge Iteresting enough I seem to can’t update with paru (pictured) or yay however updating with pacman works fine [noparuupdate]

[image] cactux: I can ping it in the terminal but not reach it in the browser. No issues connecting from a Portuguese Proton VPN server.

It’s up for me as well. Though I don’t need it :winking_face_with_tongue:

[image] MyNameIsRichard: Yeah, orphan has two meanings. Yet, no parents. :roll_eyes:

Looks like I will be using sudo pacman -Syu to update for the forseeable future while this mess gets under control and cleaned up

Malicious AUR packages

General system Newbie

thefrog June 15, 2026, 6:23pm 233

can confirm no updating aur packages