When a project is abandoned, it means no one is watching for vulnerabilities. Unmaintained code accumulates unifixed CVEs, depends on outdated libraries, relies on deprecated crypto, and may break silently in ways that create new attack surfaces.

No one is watching distribution channels. When a package is orphaned, low-visibility, niche, or unmaintained, it becomes trivial for someone to request maintainership, push a malicious update, or rely on users blinding updating. (Imagine thinking the AUR is a convenience when you have to scrutinize the initial package and every update as well as keep track of whether it’s abandoned or not!)

LiGNUx culture encourages “just install it from the AUR”, and up until recently people did it. -It was crazy convenient if you didn’t bother with scrutinizing!

The AUR isn’t the only place you can find abandoned software. -FDROID is another.

FOSS advocates love to say: “If it’s open, someone will notice.” Abandoned software proves that no one is looking, reviewing, maintaining, or monitoring.

Advice if you continue using the AUR: If upstream hasn’t updated in years, assume risk. Inspect PKGBUILD diffs before building. -This alone would have caught the malicious updates.

Paru, yay (with config), and aurutils are helpers that warn about maintainer changes.

Prefer official repos or Flatpak when possible. They use signing, review, reproducible builds, and maintainers that don’t disappear in the wind.

Why is it common? - Foss Devs Quit and Sellout on Userbase