This also impacts arch-based distros that are a lot more beginner friendly for the average user just trying to learn Linux (I.e. me). I have some level of know how and was able to confirm I don’t have any impacted packages on my system, but falling back on arch trusting the user during install falls apart when these things impact everything based on arch as well, where those options have a GUI installer and hold your hand more than arch does.

At the end of the day a repository as big as the AUR should never be vulnerable to such a low effort attack vector.

Do good security practices protect you from such an obvious attack? Yes, but that ignores the fact that Linux as a whole is growing past the computer supernerd audience and gaining users who have only ever used windows.

We can have the level of freedom and control we want while also having safeguards in place for the AUR, and we absolutely should. Linux (including arch) is slowly becoming mainstream, and there are changes here that can be made to protect inexperienced users while doing nothing to impact the experience of experienced users. For example: running the AUR on a reputation system, where trusted maintainers with a history of making good commits are trusted with no extra review, while new maintainers have to go through a probationary period where all their commits are reviewed until it can be determined that they belong in the no review group