That’s not what the AUR does. They simply provide a platform for users to share build scripts. There isn’t much they can do beyond trying to vet accounts based on flimsy metrics, or weeding things out every now and then.
The problem is that some people and even distros treat the AUR as a trusted source of software.
All user repositories (javascript, Python etc.) suffer from malware btw.; the AUR is different in that it explicitely puts the responsibility of building packages on the user.
Oh, very rigorous software engineering standards.
That’s not what the AUR does. They simply provide a platform for users to share build scripts. There isn’t much they can do beyond trying to vet accounts based on flimsy metrics, or weeding things out every now and then.
The problem is that some people and even distros treat the AUR as a trusted source of software.
All user repositories (javascript, Python etc.) suffer from malware btw.; the AUR is different in that it explicitely puts the responsibility of building packages on the user.
…
I’m still missing some palpable information about these injections/malwares.https://bbs.archlinux.org/viewtopic.php?id=313892
Absolutely ludicrous. These are very very strong packages.