It seems like a continuation from the DDOS attacks that still happen from time to time. If I was going down the conspiracy rabbit hole, I'd think some group is trying to keep linux in the press with bad/scary news to drive away growing interest and arch seems like the easiest target atm.

I think we’re going to see a lot more of this kind of thing because supply chain attacks are “cheap” to hack together with LLMs now. The attackers are just fishing, if 1 in a million of the people who get infected has a valuable or monetizable credential that they can exfiltrate, they’ll make their money back. Just like phone and text spam became ubiquitous when jank-ass phones and sims became cheap, supply chain and low effort hacking campaigns will become prevalent when jank-ass programming becomes cheap.