As recently discussed on the Arch Mailing list there appears to have been a large coordinated attack on the AUR some time within the last 24 hours that seems to have resulted in a rather sizable amount of packages being contaminated with malware. This is a good reminder that the AUR is open, unofficial, user-produced, content. The only secure way to use the Arch User Repository is by reviewing every PKGBUILD. While efforts are now underway to clean out any problem packages there still exists ...
Reading through the shell script and understanding what it does before you run it should be a given. You don’t need to trust any closed source tool or whatever. Read it, before you execute it. If you are unable to do that, Arch is probably not the right distro for you anyway and in that case, good luck.
Reading through the shell script and understanding what it does before you run it should be a given. You don’t need to trust any closed source tool or whatever. Read it, before you execute it. If you are unable to do that, Arch is probably not the right distro for you anyway and in that case, good luck.