Ah cool, Archlinux had another oopsie-whoopsie that was only communicated on the mailing lists.

They found malware on the AUR. Reminder that anyone can put stuff on the AUR and when an AUR client offers to let you inspect the package build scripts, it's because it's no one's job to make sure the package is safe.

"But people tell me to install stuff off the AUR all the time and I'm no dev that can understand these scripts" -- Yup! This is one of Arch's primary problems. It's why they make it non-trivial to bootstrap into getting stuff off AUR to begin with, but that's not enough when 98% of Arch users need something off it.

Weh.