A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
It isn’t really all that unique? Debian does it, el does it, probably almost any popular distro?
I suppose it’s become more common since PEP 668 was introduced, less unique these days.