

To potentially prevent this entire class of npm attacks in the future, you could edit
/etc/pacman.conf, uncomment
# Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
#IgnorePkg =
And set it to IgnorePkg = npm
Your system should prompt you to accept installing npm because it’s in the ignore list. These packages set it as a dependency, so that gives you a chance to notice that something’s off and refuse the install. This assumes you don’t already have npm installed or need it for some reason.
https://lists.archlinux.org/archives/list/[email protected]/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/
edit: word is that bun command is being abused as well and may be worthwhile including in the space separated list:
IgnorePkg = npm bun
the biggest problem with manjaro is the AUR, if you stop using it then manjaro is just fine