Adoption of unmaintained packages to maintain them is not a mistake. The problem is the current implementation, not the idea behind it. It's like saying the AUR is a mistake, because some people do malicious stuff.

They should find a better solution, like adoption shouldn't be granted to everyone without question, especially new accounts who didn't maintain anything before. Mass adoption shouldn't be granted automatically (limit rate), in example 1 package adoption per day and if someone wants more, admins or moderators need to approve. And updates of newly adopted packages should wait a day.

Also the AUR helpers should do a better job. Always ask if a new adopted package should be updated and give a warning the maintainer changed.

Remove unmaintained packages and block the name for several months.

Alright, but that would mean most of AUR. Have a look at the package statistics box on the AUR homepage. Most packages fall under that definition in one way or another. The vast majority of the AUR is package some random person added once then never bothered with ever again.

Frankly I'm surprised that the AUR has survived for so long in its current form, for what is basically a shell script distribution system with zero supervision and zero safety guards.

From the mailing list thread:

For the record, those are all new packages (not orphaned packages being adopted). I assume more will come, we'll clean those as soon as possible.

In the mean time stay vigilant, probably refrain from installing freshly pushed new packages from the AUR for now.

So wasn't adoption in this case. Looks like instead they submitted a bunch of git/bin versions of existing packages.

Well, just don't use AUR for everything. They don't even recommend helpers. It's ment to be tedious, to discourage usage for non-necesarry bullshit.

Is anybody really recommending Arch to new users though?

Arch as far as I am aware has never been recommended to new users. Sure their is CachyOS and other variants. And on top of that AUR you shut read the build scripts. But I suppose not many people do that unfortunately.

You have to go download an AUR helper to even get into the AUR, it does not come by default on Arch systems. You have to actually do this to yourself to get the malware.

You mean https://aur.archlinux.org/... from the list https://lists.archlinux.org/... ? It has 0 votes and Popularity is at 0.000000, since it was uploaded 2 months ago. And there is a non Git version that is not listed (probably not affected) at https://aur.archlinux.org/packages/deepseek-tui . On top of it, on their website https://deepseek-tui.org/#install the main recommended way to install it is with npm and there is even a way to build it with Rust it seems (I'm a bit unsure).

So I don't think it hit that many users, as only a couple of people since Mai would want to install it, and they have to have updated it to build from source in recent days. That is a very narrow number of people, just by my gut feeling.

What's the alternative?

all they have to do is to check the damn diff, if that's not easy for someone then they should stop using a computer altogether. I mean they could just click to random links on the internet right?

You don't have to use AUR to use Arch. Just like PPA for Ubuntu or Fedora's Copr.

Same. I was on Cachy for a few months but recently switched back to Fedora. I'm sleeping very peacefully.

Not if you follow the normal safety precautions for using the AUR. There are several things you can do to look for red flags, but the most essential thing is to read the PKGBUILDs. And helpers like yay, paru and Shelly can all show diffs which makes that much easier after the initial installation because in most cases you'll just see that the version and checksum has changed which means it's as trustworthy as last time.

This has always been the case, and will continue to be the case unless the Arch team restricts the AUR which quickly can make it lose exactly what makes it so good.

I mean, nobody is saying there is no way to prevent this, and I would hardly say that "twice" can be cathegorized as regularly.

Also I find this of extremely bad taste as you seem to compare this to school shootings, with literal children deaths. I would say that a few thinkerers getting pwned from their claude tokens is a couple orders of magnitude less serious.

Besides all the other non infected ways to install the software, there is a way to prevent this: Just read the AUR package before install and don't trust blindly any new maintainer.

Isn't this similar to the reason a lot of people hate snaps? Or am I misunderstanding something? I'm not an Arch user (btw) so I'm not super familiar with AUR.