Ugh. Look like many AUR packages compromised with 'atomic-lockfile' malware 😱 https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/ It is always JS OR npm doing nasty stuff. Stay safe folks.