

Since this installed a malicious dependency from NPM (and later with bunjs) in the pre install script, it would need at least complex correlation to catch. Maybe building and installing all AUR packages, which would cost far too much for the Arch team.
Individually and automatically scanning only the PKGBUILDs (the stuff actually on the AUR) would likely not have caught this.
That doesn’t mean it’s a bad idea to run a basic scan over every change, but it wouldn’t magically “fix” aur malware.






I have a setup similar to this, but not for ddos protection. If I were to get ddossed at a network level, my home connection wouldn’t feel much of it, as my VPS quickly gets overloaded. I have been “ddossed” at an application level though, I hate AI web scrapers. Since the entire line from VPS to my home network is 1gbps, that alongside most of my server cpu resources got oversaturated with fake traffic.
(I say ddosed in quotes, because I’m not sure of the intentions of these AI webscrapers. Thousands of requests per second on a server that’s usually seeing maybe 5 isn’t “normal” traffic either.)