aur-orphan-compromise

Hey,

there is an ongoing attack running inside the AUR. To me it seems like ChimeraOS is not affected by this, unless the user explicitly installs a compromised package manually. Still I wanted to double check here if this is the case?

Start by checking how ChimeraOS obtains packages and whether its normal operation exposes users to compromised AUR packages. Compare that path with the attack described in the issue, then document whether ChimeraOS is affected without manually installing an AUR package and record the supporting evidence.

Written by the indexing model from the issue text.