GCVE-110-AUR-2026-001135

The Arch User Repository (AUR) package `nodejs-istanbul` was identified as malicious during the June 2026 AUR supply-chain compromise, in which an attacker pushed backdoored PKGBUILDs to roughly 1,900 packages. Building or installing the affected package executed attacker-controlled code. The malicious revision has since been removed from the AUR. Upstream package description: "Yet another JS code coverage tool that computes statement, line, function and branch coverage with module loader hooks to transparently add coverage when running tests. Supports all JS coverage use cases including unit tests, server side functional tests".