"Over 900 packages infected in a repository anyone can upload to, it just has to be compatible with Arch"