Hi, aside from the fact that anyone can accidentally overlook something, it's also possible that attacks are more tricky and that an issue might be hard to spot.
I think we users need to enable notifications for every package we use so we know when an orphaned package is adopted by someone. The problem is that you might miss packages that are moved from the official repositories to the AUR, so users never enable notifications. I see this as a major problem. So we would have to check regularly to see if any packages have been moved to the AUR by using pacman -Q --foreign or something else. Regards, Ralf
