[2bluesc]

Should note this only applies to AUR packages and `-git` mostly because of missing archive hashes.

AUR packages pinned to mutable tags are easiest to hijack.

[_emacsomancer_]

article notes that they "found nine vulnerable packages (in the community repository)"