Absolutely. This happens infrequently, for any number of reasons. At one point, though, these packages were most likely a dependency (build or runtime) of another package that’s no longer installed.
Yeah I remember it happening with the maliit virtual keyboard not too long ago.
This is a bit different in that the package still exists in a different form. I expect on new ISOs the older litehtml package wont ever be installed.
I wonder where @Jim 's python-pkg_resources came from though. I don’t have that installed.
kokochu:
python-pkg_resources
This link pretty much sums it up:
opened 07:03PM - 27 Dec 23 UTC
From the `pkg_resources` docs:
https://setuptools.pypa.io/en/latest/pkg_resourc… es.html
>Use of pkg_resources is deprecated in favor of [importlib.resources](https://docs.python.org/3.11/library/importlib.resources.html#module-importlib.resources), [importlib.metadata](https://docs.python.org/3.11/library/importlib.metadata.html#module-importlib.metadata) and their backports ([importlib_resources](https://pypi.org/project/importlib_resources), [importlib_metadata](https://pypi.org/project/importlib_metadata)). Some useful APIs are also provided by [packaging](https://pypi.org/project/packaging) (e.g. requirements and version parsing). Users should refrain from new usage of pkg_resources and should work to port to importlib-based solutions.
Python 3.12 has removed `pkg_resources` from the standard library (moved to `setuptools`):
https://docs.python.org/3/whatsnew/3.12.html
>[gh-95299](https://github.com/python/cpython/issues/95299): Do not pre-install setuptools in virtual environments created with [venv](https://docs.python.org/3/library/venv.html#module-venv). This means that distutils, setuptools, pkg_resources, and easy_install will no longer available by default; to access these run pip install setuptools in the [activated](https://docs.python.org/3/library/venv.html#venv-explanation) virtual environment.
And we use it in the `resources/__init__.py` file:
https://github.com/mu-editor/mu/blob/c38a539aae05cd4e0eaa93a3067addfaf8c7bd3d/mu/resources/__init__.py#L20
Good news is that the `importlib_resources` backport library contains documentation on how to migrate:
https://importlib-resources.readthedocs.io/en/latest/migration.html#pkg-resources-resource-filename
@ajgringo619 Thanks for all your help in this thread!
Mellow
August 2, 2026, 6:15am
27
Hard to give a definite answer here because there are so many on this forum alone… Many wrote scripts to check if you were affected when like the first wave of attacks happened, here are some threads
From CachyOS Moderator cscs
TL;DR
Here’s what I got…
─❯ curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh | bash
Checking for infected AUR packages (480 total)...
Clean: None of the known infected packages were installed within 48 hours of the campaign.
─❯
Hi fellow EndeavorOS users,
I orginally posted on Reddit and was advised to post it here too so here I am
I wrote a small shell script that scans your system for any trace of the payload in your AUR cache and system, in accordance to the findings made by `ioctl.fail` and Sonatype.
It tries to be a bit smarter than just checking against the evergrowing package list (Vector and payload name rotated already, there’s now at least `atomic-lockfile`, `js-lockfile` and `digest-js`, injected by eithe…
This project is still in beta, but probably more interesting for all the things it can check
Arch Linux security canary — layered AUR supply-chain scanner with systemd, eBPF, and kmod auditing.
If you run pacman -Qm it will show you any apps that are not currently in the official repos which includes ones from the AUR.
It also includes official packages that have been removed from the repos though so it doesn’t necessarily mean it came from the AUR.
Either should warrant your attention though.
ddnn
August 2, 2026, 7:35pm
29
Another reason for this error message could be a previously used repo, like Chaotic-AUR, another distro’s repo, or installing a package using `.zst` file.
I got the message today when updating and removed both python-pkg_resources and litehtml0.9 using
yay -Rs python-pkg_resources litehtml0.9
(after checking, of course).
Also updated @cscs ’s wonderful maclean script from his GitLab (now has --version, hooray!) and did some further cleanup.
No adverse effects so far.
Jim
August 3, 2026, 5:23pm
31
Thanks, I will check it out.
Jim
August 3, 2026, 5:33pm
32
I just used the pacman -Qm command and it looks like I have some packages that were once in the Arch extra repository but now have been moved to the AUR.
Thanks!
