Thinking about this, as an AUR user I'm used to watching the build process abstractly flow by as you run updates. Adding the malware injection during build would probably get noticed a lot more/quicker as they were adding calls to run npm - builds would either fail (no npm installed, me) or they'd start sucking down unexpected artifacts (why is this python module doing npm things). Injecting it in the post-install logic hides it, where failures can be ignored.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。