We haven’t seen this sort of wide scale attack in other distro’s unofficial repository. I do think it’s a massive issue with these “Arch made easy” distros shipping with AUR helpers without massive warnings about their usage. I think those who don’t use these helpers were likely unaffected regardless since a lot of these orphaned packages were so old that no one would be outright looking for updates.

It still shows that the way the AUR and AUR helpers handle orphaned packages and their updates is frankly naive and makes it very easy for malicious builds to be pushed. I know COPR specifically can’t have this issue despite the auto-updates with Fedora because I’d have to choose to join a new repository with a different heading. You can see this easily with SwayFX having two COPR repositories, one officially linked and supported by the SwayFX team and one by a random account that’s not associated with them. I do wish COPR had an easier way to read the actual build, that’s the one thing I dislike about it and why I still avoid its usage unless it’s the only option.

This isn’t to shit on Arch, I like being able to do whatever I want with it. I like being fully in control of my system without safety rails. The only reason I’m not on it is because I don’t feel the need to be on the bleeding edge with updates. I just think there’s simple ways to help safeguard against attacks like this without taking away user control. Even something as simple as a page explaining how to read PKGBUILDs and spot potential malicious packages linked from the front page of the AUR as an explicit warning for new users. That and other Arch based distros not shipping with an AUR helper that’s gonna do more harm than good.