Tellico 4.3.1 is available, with a few updates.
I’ve been DJing a lot lately, and as it happens, I like Denon DJ hardware. Most commonly, you will find gear made by Pioneer (AlphaTeta) though, and switching between mixers and their eco-systems is quite a pain. Pioneer has properly locked down the market, while Denon, in my opinion, offers way more value for money, and just nicer hardware. Out of frustration when moving from my home setup to mixers elsewhere, I figured, why not just write a small commandline tool that syncs the cue points that I’ve created on my Denon mixer to the Pioneer library on the same USB stick. Should be easy, right? Ow, sebas, you sweet summer child…
Now at work, we use AI tools to help us write code and it makes me quite a bit more productive as a programmer. While I understand (and even agree to) some of the criticisms that exist around the use of AI in the Free Software I think that AI is there to stay, and that, if used well, can make our lives as (Free) software developers a lot easier. KDE’s contributor guidelines allow the use of AI and give clear guidelines about what is OK and what is not. There have of course been discussions in the community around AI, but those are mostly about AI-aided contributions to existing software, not so much an existing KDE developer using AI tools to develop a new application. Nobody wants AI slop and we should be careful and thoughtful about how we use AI in our work and interactions. So far, my experience has been rather good. I have tried to be thoughtful at all times, and acknowledged that everything I do (with AI or not) is my responsibility. Being mindful about others is very important. Not just in this context, of course.
So in the past months I put together a new tool, called Seabass. I’ve shown an initial version to some of my DJ friends and got a lot of good input and direction, as well as support and of course testing, as well as a few suggestions for things that would make really valuable additions. There is a fair amount of frustration around, especially, but not limited to Rekordbox, the software created and sold by Pioneer/AlphaTeta alongside their hardware offerings, and frankly, there’s a lot to be improved as well. (Honestly, reading the rekordbox subreddit makes you think of Stockholm syndrome more often than “what a cool hobby!”.)
Seabass has already become a very valuable tool for me. I can now DJ at home all I want, prep my sets and then take my USB stick elsewhere, plug in and play. I have asked my friend Nuno Pinheiro to make an icon for Seabass, and not only did he agree, he blew me away with our very cool Seabass mascot. Thank you so much, dude!
Seabass allows me to explore, sync, back up and maintain my music collection more easily. Not at least, I can finally use my precious Linux for my DJ hobby! Seabass provides powerful tools that make your library more transparent and provide greater control over it. Next to its library management tools, it also provides a benchmarking tool, measures and tells you when your USB stick is dying, allows you to quickly transfer things, to either your harddisk or another stick. All incremental, all designed to be as bullet-proof and forgiving as possible.
The scope, as it happens, has shifted somewhat. I’ve slowly been adding creative features to Seabass as well, and the effect on my sets has been noticed.
So, today, we present Seabass 1.0. Your DJ Toolbox. I want this to be the creative and open space, as well as the tools that make many DJ’s lives easier, less frustrating, more fun and of course, more Free.
As it stands, youstill need rekordbox to import and analyze the music. The algorithms that analyze the music to produce the waveform and beatgrid data is not something I can emulate or replace, at least not at the expected quality (yet?), so for now, you still have to use rekordbox to import your music.
My living room now has 4 DJ mixers of different sorts (for testing), and it’s been quite some fun reverse-engineering the peculiarities of an XDJ-RX2 (running an embedded version of rekordbox, btw), making sure cue points land on the exact spot they should, taking into account mp3 encoders used for a given track, very interesting ways these machines use to read and save their user’s inputs. If you’re into rabbit holes, come and get some!
Seabass runs on Linux, Mac and Windows. For Mac, there are now universal binaries, which means: pretty much any computer made in the past ten years should be able to run Seabass. KDE’s cool Craft project alongside KDE’s pretty awesome CI infrastructure provides the legwork for this. A big thanks to the KDE team, and especially Ben Cooksley for helping me get this done!
Seabass itself is structured in layers, there’s a commandline tool called seabass-cli which makes it a lot more transparant to see what’s going on under the hood. Unittest coverage is at a decent 80+%, with the remainder taken care of by a suite of end to end tests that I run on all three target platforms., plus a ui test suite that exercises and checks most of the QtQuick code. There’s a feature for users to submit an anonymized version of their library, which can be added to the testing suite.
Seabass acts on, and keeps 3 database formats in sync. Pioneer’s DeviceLibrary, Pioneer’s OneLibrary format (yes, two…) and Denon’s Engine format. While developing Seabass, a fair amount of reverse engineering had to be done. I’ve upstreamed a bunch of patches to especially libdjinterop.
Since Seabass is about music, you can also use it to listen to your tracks and playlists. The beatgrid and waveform data that has been to the track actually makes a wonderful base for cool animations. Let’s just say I did have some fun with OpenGL shaders, manifested in the play animation (which can be made full screen).
I haven’t done a lot of Free Software work in my free time in a while, but with this, I’ve found back some of the energy and a new project to dig in to. And it’s good to be back!
So... Dr Jekyll sat down to draw a few small icons. Eleven days and 2,842 commits later, the laboratory is getting rather crowded. And this is still the Dr Jekyll part.
“Just one more icon” is apparently a dangerous thing to say. A row needs inserting. A column needs hiding. Then there are merged cells, borders, filters... and suddenly the spreadsheet tools have become a small population of their own.
The experiment has spread into drawing and image tools, selections, clones, alignment and distribution, colour controls and paths. Then version-control graphs, users and groups, debugging, and Amarok’s filename and music controls. There is always another little corner asking for attention.
Jekyll is rather pleased ehhheheheaahahahahaa... hehehe behold the creation ...
The commit count includes revisions, size variants, naming and cleanup. These creatures need quite a few visits before I let them out of the laboratory 
Then comes the slightly terrifying realisation: I now have hundreds of icons to do for full-colour Oxygen as well. The symbolic work has been kinda writing the instructions for a much bigger horrible experiment.
Well I haven’t created that other monster yet. The full-colour one is still waiting to be brought to life... and it promises to be a far more terrifying creature. Mr Hyde hasn’t even entered the laboratory.
But there is good news! We have more victims... *cough* volunteers helping me now. Mwahahaha! So at least I have some company in the laboratory. I should probably warn them about what is still waiting downstairs 
Anyway... just one more icon.
“Boiling the Ocean” is a sprint/hack days event series from GNOME with varying subjects, which I and a few others from KDE have been joining recently to discuss and collaborate on overlapping topics.
I have written about the state of NFC support for Plasma Mobile back in August, and a lot of this is common infrastructure for all Linux platforms, and it has to be to avoid making things messy as hardware access tends to be exclusive.
Together with the GNOME team we looked at our options for the Linux NFC stack. Beyond the ones mentioned in the above linked post there’s an additional one from Tizen. We agreed however that for now we’d try to make neard work first. My fixes for neard have meanwhile been integrated, which gives me some hope that might actually be viable.
The next steps would then be:
With that we should be able to support e.g. the AusweisApp use-case or reading FIDO2 tokens.
I hit a wall on the first item already unfortunately. There’s an attribute in the kernel API (NFC_ATTR_TARGET_ATS)
to retrieve this information from tag discovery information, which however always returns an empty result, as this
only becomes available later, during tag activation. And at that point there is no way to read it out anymore
as far as I can tell.
All this is just a start though, there’s much more to do:
See also the Boiling the Ocean 12 notes for more details.
Another topic to collaborate on are XDG Intents, which brings an important and powerful piece of infrastructure to Linux.
Besides the spec itself, there’s common tools such as the desktop-file-utils, which meanwhile have support for generating indexes of all available Intents.
On top of that we can then build the integration into KDE:
The first standardized Intent is the Terminal Intent, for which there’s also all required pieces in review meanwhile:
I don’t have the same level of insight on the implementation on the GNOME side, but with Glib support merged and terminal intents implemented this also looks well under way.
It’s not all about technical implementation details though. There’s also overlap in more fundamental questions on the vision of what we actually want to achieve and why we are doing all of this, in particular for those of us who have different ambitions than just being a random part of a software supply chain.
We went through a similar discussion about 10 years ago in KDE, resulting in the vision of a world in which everyone has control over their digital life and enjoys freedom and privacy. That’s still valid today I think, but one aspect is starting to show its age as the world has been changing since then.
The distinction between the digital life and the “real” life have been disappearing as more and more aspects of life involve some kind of digital interaction nowadays, such as mobility and travel, handling money, accessing your health records, or for setting up a new appliance. There’s the German term Digitalzwang describing this, which unfortunately doesn’t have a similarly compact English equivalent, meaning being forced to use (proprietary) digital means to use a service or participate in a certain aspect of society.
Rejecting that and asking for a right to participate in all of that entirely without digital means is a valid approach, but doesn’t address this entirely IMHO. I can travel with a paper ticket, but I wont be able to benefit from accurate up-to-date information in case of disruptions then. I don’t want to miss that and I don’t want to be forced to make a decision between a fully offline approach and using a proprietary app on a proprietary platform.
While there are technical aspects to addressing this, the bigger and harder part is actually political. We need guaranteed and fair access to the necessary interfaces, standards and procedures to interact with the “real” life things in order to provide free and open alternatives.
Related to this is the topic of dependencies on cloud services. The GNOME team is doing interesting work with peer-to-peer networking, which could address parts of this, e.g. when it comes to collaboration tools and sharing your own data.
The ability to self-host is another part, and a necessary prerequisite. It’s not a solution in itself though, as hosting services yourself isn’t really accessible for most people.
There’s also services where wide-spread self-hosting isn’t viable for other reasons, Transitous is such an example. While that’s not even particularly complicated to set up for what it does, it only scales in very large increments. This means you can’t start with something small like the stereotypical Raspberry Pi but need a rather big server, and that’ll then be to handle way more requests than you likely need.
So we also need to figure out how can we run services as a community in a way that’s sustainable in the long run, and how can we design fair usage rules for those.
Another aspect is looking at the negative impact our work causes, and minimizing this, like KDE Eco has done and is doing.
While ideas like permacomputing and hardware longevity were initially motivated by considering the climate and human rights impact of buying new devices, in the current situation it has become a simple necessity given the very limited availability of (affordable) hardware.
In the light of this it is even more painful to have to take decisions like dropping support for older Android platforms.
None of the above is something that anyone of us can solve on our own, this needs much bigger coalitions than just GNOME and KDE even. But with the distinction between the “digital life” and the “real life” fading away and rampant enshitification there’s also many more people affected and interested in these topics now.
That’s just picking three topics from three different events, there are many more things that have been discussed and which benefit from coordination and collaboration, such as XDG portal APIs for contact and calendaring data, or scalability issues we observe with the current push notifications design, so there’s more to come.
Welcome to a new issue of This Week in Plasma!
This week a significant technical milestone was achieved: the XWayland compatibility layer is now loaded only when needed. Previously it had always been running even when no apps were using it, and fixing this required porting various system services away from legacy X11 code paths. This work was done by Vlad Zahorodnii, David Edmundson, and David Redondo, and will ship in Plasma 6.9.
But that wasn’t all, not by a long shot! Check it out here:
You can now quickly forget networks from the Networks widget, not just its associated page in System Settings. (Peder Bergan, KDE Bugzilla #525852)
The System Monitor app and widgets now include a sensor that lists the number of physical CPU cores. (Méven Car, ksystemstats MR #157)
System Settings’s Task Switching page has been ported to QML, with a substantially improved UI and the Overview effect’s settings included. (Oliver Beard and Tobias Fella, kwin MR #7604)
System Settings’ Date & Time page has also been ported to QML, with a simplified single-page design that makes it faster to change the time zone when needed. (James Graham and David Edmundson, plasma-desktop MR #3653 and plasma-workspace MR #6884)
The desktop wallpaper configuration page now reserves more space for wallpapers, thanks to moving the combobox used for selecting the desktop type over to the “Layout” page. (Ramil Nurmanov, plasma-desktop MR #4113 and plasma-workspace MR #7294)
New
OldThe Folder View widget and desktop icons now give you more size options, filling in a huge size gap between the largest size and the size right before it. (Nathan Heller, KDE Bugzilla #521201)
Spectacle’s darkened overlay now fades in and out. (Kai Uwe Broulik, spectacle MR #624 and kwin MR #10360)
When a grouped Task Manager task is flashing to get your attention, opening its group popup now reveals which specific window wanted attention. (Christoph Wolk, plasma-desktop MR #4225)
The Timer widget now lets you change a timer’s duration in the conventional way, without having to scroll over it. This also fixes some theming-related glitches. (Christoph Wolk, kdeplasma-addons MR #1251 and KDE Bugzilla #522797)
When using the Media Frame widget to show only a single image, it no longer cross-fades between that image and itself. (Christoph Wolk, KDE Bugzilla #518053)
The Comic Strip and Media Frame widgets now use consistent floating toolbars for their “Previous” and “Next” buttons, improving visual consistency and Fitts’ law adherence. (Christoph Wolk, kdeplasma-addons MR #1236 and kdeplasma-addons MR #1238)
System Settings’ Keyboard page no longer lets you toggle custom layouts on or off; it assumes that you want to use the system-wide keyboard settings until you add some custom ones, and now it clearly informs you of this. (Tobias Fella, plasma-desktop MR #3825)
Breeze-styled sliders now have nicer-looking tickmarks when using a fractional scale factor. (Eike Hein, breeze MR #649)
Plasma’s network share setup wizard is now more intelligent about populating its settings fields with information from a pasted URL, including the network protocol and whether the connection should be encrypted or not. (Méven Car, plasma-desktop MR #4216)
Job transfer notifications now show a prettier representation of the destination in cases where the destination is a special URL like desktop:/ or trash:/. (Tobias Fella, plasma-workspace MR #7391)
The Media Controller widget no longer shows tickmarks on its playback slider for media shorter than a minute in length. (Christoph Wolk and Yuma Kakei, plasma-workspace MR #7260 and libplasma MR #1608)
The Wobbly Windows effect (which you should absolutely be using) now includes some fun named presets for different levels of wobbliness. (Antti Savolainen, kwin MR #10308)
Throughout Plasma and Kirigami-based KDE apps, buttons that show text will no longer ever display a hover tooltip with the same text, because that’s silly. (Kai Uwe Broulik, kirigami MR #2232)
Focusing a QtWidgets-based KDE app by clicking on its hamburger menu button now changes all of the window’s colors to their focused versions, rather than only after the menu was closed. (Kai Uwe Broulik, KDE Bugzilla #452212)
The Task Manager widget’s textual list popup now looks correct when using a right-to-left language like Arabic or Hebrew. (Christoph Wolk, plasma-desktop MR #4197)
Fixed an issue that made pointers look a bit jagged in screencasts taken on screens using fractional scaling. (Anton Lisovskiy, KDE Bugzilla #528423)
Fixed an issue that made the Color Picker widget sometimes draw a contrast circle around saved colors at inappropriate times. (Christoph Wolk, kdeplasma-addons MR #1253)
Fixed an issue in the Color Picker widget that prevented middle-clicking on a preview from copying the color to the clipboard. (Christoph Wolk, kdeplasma-addons MR #1254)
Fixed a case that could make the screen locker crash (without unlocking the system, so there was no security issue) in certain cases when a screen was disconnected while the system was sleeping. (Drew, KDE Bugzilla #528438)
Fixed a case where System Settings could crash when the Wallpaper page was open and a screen was disconnected. (Nikolai Nyegaard, KDE Bugzilla #528380)
Fixed a recent regression that caused visual corruption on certain systems with Intel CPUs and NVIDIA GPUs. (Xaver Hugl, KDE Bugzilla #527163)
Fixed a recent regression that made the systemwide color picker fail to include a picked color’s alpha channel. (Jean-Baptiste Mardelle, KDE Bugzilla #528396)
Fixed a visual glitch on System Settings’ Color Scheme page that made some previews visually overflow. (Akseli Lahtinen, KDE Bugzilla #528106)
Fixed a subtle issue that caused inappropriate default scale factors to be chosen for some laptops and handheld gaming consoles. (Xaver Hugl, kwin MR #10327)
Global Themes once again correctly apply non-default font settings. (Alexander Berg, plasma-workspace MR #7340)
Hardened KWin against crashing when a game like Elden Ring sent it invalid HDR data. (Xaver Hugl, KDE Bugzilla #528428)
Fixed a case where Discover could crash when you asked it to trash the orphaned data of an uninstalled Flatpak app whose runtime had also been uninstalled. (David Edmundson, KDE Bugzilla #528572)
Fixed a somewhat common way that Discover could crash on operating systems using its RPM-OSTree backend, including Fedora Kinoite and Bazzite. (Aleix Pol Gonzalez, discover MR #1445)
Fixed an issue that would make Plasma freeze if you put the Window List widget into a vertical panel wider than 144 pixels. (Christoph Wolk, KDE Bugzilla #527314)
Fixed a regression that could make certain fullscreen windows visually freeze when screen tearing was allowed and atomic modesetting was disabled. (Xaver Hugl, KDE Bugzilla #528579)
Fixed a regression that made it impossible to drag files and folders on the desktop across screens if their filenames contained URLs. (Akseli Lahtinen, plasma-desktop MR #4205)
Fixed a regression that made the “Add Widgets” sidebar sometimes open on the wrong screen of a multi-screen setup. (Niccolò Venerandi, KDE Bugzilla #528201)
Copying text on Info Center’s “About” page that you selected with the pointer now copies just that text, and the little message that tells you about it is now correct, too. (Tobias Fella, kinfocenter MR #324)
The Plasma Browser Integration plugin no longer breaks the ability to share your screen using Microsoft Teams. (Kanishk Ranjan, KDE Bugzilla #507991)
Using an Alternate Calendar plugin in the Digital Clock widget no longer forces its events panel to appear when it would otherwise remain disabled. (Tobias Fella, KDE Bugzilla #497122)
Spectacle is now even faster to launch, thanks to further optimizations and parallelizations. (Kai Uwe Broulik, spectacle MR #625 and spectacle MR #626)
The “Add Widgets” sidebar is now substantially faster to open, with a smoother animation, too. (Kai Uwe Broulik, plasma-desktop MR #4224 and plasma-workspace MR #7398)
Window thumbnails in the Task Manager widget no longer wastefully regenerate themselves when the pointer leaves them and returns, avoiding some unnecessary work and fixing a slight visual flicker. (Christoph Wolk, libplasma MR #1629)
If you’re using Plasma Login Manager as your login manager/greeter and it breaks for whatever reason, now it includes a simple fallback that at least gets you to a terminal, rather than stranding you at a black screen. (Harald Sitter, plasma-login-manager MR #232)
KDE has become important in the world, and your time and contributions have helped us get there. As we grow, we need your support to keep KDE sustainable.
Donate to KDE’s current fundraiser! We’ve raised 42% of the funds we need to be in a better position for next year, so every little bit helps!
Beyond that, you can help KDE by directly getting involved in any other projects. Donating time is actually more impactful than donating money. Each contributor makes a huge difference in KDE — you are not a number or a cog in a machine! You don’t have to be a programmer, either; many other opportunities exist.
You can also help out by making a donation! This helps cover operational costs, salaries, travel expenses for contributors, and in general just keeps KDE bringing Free Software to the world.
Push a commit to the relevant merge request on invent.kde.org.
Let’s go for my web review for the week 2026-46.
Tags: tech, foss, commons, community
Nice paper about how commons are built. Peer-production is really a powerful way to organise.
https://thereader.mitpress.mit.edu/from-linux-to-wikipedia-how-volunteers-build-the-internet/
Tags: tech, web, indie, culture
Neat place to discover plenty of other fascinating or quirky websites.
Tags: tech, 3d, blender, foss
This is again a very strong release from Blender. Lots of neat features. Kudos to them!
https://www.blender.org/download/releases/5-3/
Tags: tech, foss, politics, history
A reminder of where Free Software comes from. It’s never been apolitical mind you, claiming the contrary is misreading history.
https://foss.life/notes/2026/the-myth-of-neutral-code/
Tags: tech, foss, licensing, politics
More new licenses are surfacing. It looks like the Free Software licenses ran their course but are not enough anymore.
https://dustri.org/b/weird-licenses-and-the-new-open-source.html
Tags: tech, politics, history
Or the importance of community and studying other fields. The political landscape around tech has led to a turbocharged dystopia but there are other ways. Any bubble of humanism in the margins is precious and has to be kept. It’ll be needed someday.
https://theinternet.review/2026/02/17/are-we-the-baddies/
Tags: tech, innovation, politics, law
Interesting essay. It’s very much attuned to the US context but it’s a timely exploration of the current handling of innovation in our societies. Interestingly we’ve forgot that innovation and progress don’t necessarily go hand in hand. This isn’t without bad consequences.
https://www.andreamm.com/_files/ugd/26d278_b60b4140feb34bf2bfb6ab7405a27e99.pdf
Tags: tech, ai, machine-learning, gpt, google, search, fake-news
It’s a good illustration of how information channels became very fragile. LLMs based systems reaching for openly available information on the web are very susceptible to being manipulated.
https://lyra.horse/blog/2026/11/disinformation-machine/
Tags: tech, programming, ai, machine-learning, copilot
Another good balanced post on the reasons to resist using LLMs for development.
https://www.polso.info/why-i-will-not-be-using-llms-coding
Tags: tech, compiler, memory, rust
A good introduction on how and why compilers track pointers and memory locations. Also shows what can be used with Rust to handle provenance.
https://sofiabelen.github.io/projects/pointer-provenance-in-rust-vs-cpp/
Tags: tech, networking
This is wild! The amount of stuff which happens to listen on port 0 is surprising.
https://acid.vegas/blog/the-port-that-does-not-exist/
Tags: tech, xmpp, standard, unicode, emoji
A deep dive in this funny question. This is a nice tour of a few RFCs around XMPP.
https://op-co.de/blog/posts/emoji_xmpp_address/
Tags: tech, physics, funny
Cool little simulation. Wondering how an iceberg might float? Draw your own.
https://joshdata.me/iceberger.html
Tags: tech, spreadsheets, animation, funny
OK, this is definitely quirky and funny. It shows that any medium can be used if you’re motivated enough to create art. :-)
Tags: science, biology, death
If you ever wonder about what will happen in your body in the end. This gives a good idea of the process and it’s longer than what we usually have in mind.
https://www.youtube.com/watch?v=fEjvSbI_PT4
Bye for now!
Friday, 13 November 2026
KDE today announces the release of KDE Frameworks 6.32.0.
This release is part of a series of planned monthly releases making improvements available to developers in a quick and predictable manner.
sebas
@vkrause:kde.org
x-audacity-project+sqlite3. Commit. Fixes bug #527329Kwi has continued to mature at a fast clip over the past week, with many a bug slain and a significant amount of UI refinement.
Exciting news also from our important upstream, the Ghostty project: Earlier than we had anticipated, libghostty-vt was released in version v1.0 on the weekend. This provides Kwi with a stable API/ABI from our headless terminal emulation backend, which will greatly aid distros and packaging efforts in particular.
For the Ghostty project this is the culmination of a solid half-decade of work - congratulations to mitchellh and many other contributors over there!
Shift-click now extends selections, just like in Konsole (feature request #528514)i character to act up when LCD filtering was disabled in the text renderer (bug #528550)Ctrl+Alt+I shortcut (requested on reddit)timeout -s instead of timeout --signal=; reported on Matrix)libghostty-vt dependency first to v1.0, then to v1.0.1Additionally, because Kwi is built on KDE's latest technologies, we sometimes get to find and fix bugs upstream of the project, or contribute new features needed by Kwi.
Alt+Arrows as shortcuts in Kwi (MR #2234, bug #528659).As mentioned last week, Kwi continues to undergo the "KDE Review" process at the moment, a community quality gate through which it will graduate to become an official KDE project. While we have already completed the required checklist, the minimum mandatory duration is two weeks. Kwi will complete this on November 18th.
Shortly thereafter we plan to tag a v0.1 release and publish to Flathub!
Also mentioned last week, we're working on a way to make it easy to switch classic KDE apps such as Yakuake and Dolphin to embed Kwi.
While the Kwi-side bits have been in place since its initial publication, this is mainly about providing a central setting to make this easier for users (currently it requires fiddling in the filesystem). We now have a prototype implementation, and plan to submit a merge request to the relevant KDE project (roughly in the dependency stack of System Settings) soon.
Now the bad news: Expect Kwi development to move a bit slower in coming weeks, and focus mainly on important bug fixes. There may even be a brief interruption in this newsletter! The reason is brief interruption by work on other projects related to things nearly as old as UNIX terminals.
Once we are back to full capacity, we plan to begin work in earnest on the implementation of the much-requested Split Panes.
KDE e.V., the non-profit organisation supporting the KDE community, is looking to hire a software engineer to help improve the software stack that KDE software relies on. Please see the call for proposals for more details about this contract opportunity. We are looking forward to your application.
The full call for proposals has more details.
It has been brought to the attention of the KDE security team that NeoNova Animated Wallpaper (https://github.com/abbygraceton1992/NeoNova-KDE-Wallpaper) is shipping malware.
This report came from Serg Star who spotted it reviewing this code. It's great that we have people spotting this stuff, though it may be too late for some.
The package looks very legit, its an animating wallpaper that works as advertised, they even did later commits on top adding configuration options!
However since the initial commit the code has been shipping hidden malware.
A script (hidden in a base64 string in a base64 string) makes a web request to download an "image", which is another bash script which in turn downloads a libary .so file into ".config/Plasma6Library.so" and launches it via LD_PRELOAD=~/.config/Plasma6Library.so sleep 999999
The payload thus far looks like this: https://github.com/BishopFox/sliver which is designed to allow remote control.
If you have installed this wallpaper, a good test would be checking for .config/Plasma6Library.so and I would suggest starting anew.
There is only so much we can do with 3rd party content. We have reported it to all relevant places including Pling and OpenDesktop who have taken swift action within hours of us getting the report.
It it a stark reminder to be vigilant and wary when installing external content from other sources especially those that run in unsandboxed contents, and a reminder to those of us working on the Linux desktop to continue working on technologies that allow for safer and better distribution.
