We have locks on our doors for a reason. Any software that allows updates and relies on the honor system of "someone else must have checked this" will get hacked. Every day there's yet another certificate or secret stealing infection that is in some random upstream dependency in your dev tools or shell scripts or whatever.

Yes, my point being this isn't some 'Desktop Linux security' hole. This was a known and intentional model of how the AUR operated for decades. Unfortunately it was bound to get exploited like this and so it did.

> Any software that allows updates and relies on the honor system of "someone else must have checked this"

That is never how the AUR was supposed to work. Updates were intended to be a manual process where the user reviewed changes to the PKGBUILD.

Yes but realistically trust is necessary, as users can’t audit all source code. The fact the source code is even audited is, in it of itself, a blessing. Google Play and the App Store don’t do that, and those are trust based systems as well. And naturally, malware slips through, as it always will.

The AUR is not like Google Play. Arch has https://archlinux.org/packages for that. The AUR is like an APK from a Reddit post.