Airfried

I would bet even careful Arch users don’t sift through every repo they have installed during every system update to make sure nobody tinkered with an older one today. Some may have written elaborate scripts that warn them when for example the owner of a package changed but that’s probably less than 1% of even just older Arch users. If it even exists at all.

I don’t think this is just a growing skill issue. I suspect the main reason this seems to happen more frequently is mere popularity. More popular means there’s more to gain for bad actors.

Sounds far fetched. Like from another dimension kind of far fetched.