I start to wonder if we need something sitting between extra and aur, few more trusted maintainers and well secured update process that’s more than the aur Wild West

Also, some sort of yay hook to do some scanning for suspicious diffs and warning or skipping those packages…

I don’t want / need a system where I can blindly update everything, but something to help me avoid having to visually check every package diff would be nice

https://aur.archlinux.org/ warns you about it

To answer your question, generally yes the package maintainer is the one who maintains the package for the current version of the distro, even if upstream is unchanged. If a package is no longer compatible and no one is making it compatible, then yes it's unmaintained and should be removed.

Very normal looking. /s

I read a reddit thread about this.

Basically they are significantly safer because the review process is tedious and the PRs take ages to get reviewed. More over the read-only nature of the nix store make most of those techniques useless. You cannnot just take over packages the AUR way.

Moreover, if you use third party nix flakes, you are still safer because they are tied to a specific github repo, so if it gets forked by malicious actor you won't get that update.

However you are still prone to upstream malware. That is nixpkgs probably won't add malware but it could be there before packaging.

Arch and AUR are not really the same. To be fair AUR is the fanfiction version that fits inside the story. But you have to purposely work to use it. So it's not Arch that was compromised.

I use AUR BTW!

What happens is this:

Arch Linux says the AUR is just a collection of user scripts. Use at your own risk. Anybody can upload some shit. Always check the PKGBUILD before you continue. Never use so-called AUR helpers to automate the process to the point that you have less control, also wrt future updates and upgrades.

Then some Arch-based distros create AUR helpers and integrate them into their distro experience, even with automatic updates & upgrades and GUIs and whatnot. Some of these distros are very popular, even more so than Arch Linux itself, in the short term. This also contributes to the pollution of the AUR. Malicious hackers are never attracted to a less popular distro that requires its users to understand what they're doing.

Blame those distros and all who contribute to AUR helpers, or tend to not read the PKGBUILD before installing - not the AUR itself.

Yeah, I admire the arch linux's team transparency. A non-power user might see these news and think "linux is dangerous", without thinking that windows and mac also have malicious programs that can be installed too.

I haven't seem all packages, but some of them seem shady and with 0.0 popularity on the AUR, it's already suspicious by itself. People gotta be careful when installing AUR packages.

Is the checker also malware?