[snvzz]

It is safe to assume that at least one actual Arch developer was compromised by this.

The followup attack on Arch itself is not going to be pretty.