tl;dr: Arch Linux's AUR user-contributed repository was hit with a malware incident that ultimately affected over 1,579 packages — far more than the initially reported 400. Developers say they've now deleted all known malicious commits, though they note the published list still doesn't capture every affected package.