By the way, secure open trust systems are hard. Around 2000, there was a FOSS web site called kuro5hin.org, a slashdot-sryle discussion board, which experimented with trust networks. As far as I remember, they did not find a good solution.

Wikipedia or stack overflow has the same issues.

I think a kind of real-life-based(!), signature-based web of trust like the GnuPG web of trust (but ideally with more user-friendly software....) could be part of the solution

The problem with these supplychain / wateringhole attacks, is the reputation hit is harder to deal with.

If anyone thinks they'll stop using an AUR package and just install a container, flatpak, etc... they can still be vulnerable, but they're not using AUR, NPM, etc...

I just hope there were enough forensics to make a sensible improvement in security policies & procedures, rather than just guessing what next to do, and then AUR will be stronger for it.

WTS AUR account, pm for details