Yes, indeed they might, but if you start seeing sketchy stuff like that, then don't continue, I'm not sure I understand what's hard here. Or do continue, but then if those are AUR packages themselves, review them as such. Personally I just ignore anything not built from official binaries/sources.

If the PKGBUILD depends on more stuff then just officially available things, don't blindly install it and wish for the best. Just like if you "curl | bash" install something, you do at least look at the URL right? It takes a couple of seconds, maybe tens of seconds if you don't recognize the domain/github organization since before.

▲

bondarchuk 2 hours ago | parent [-]

Ah but you switched now from "I don't think people do this" to "people shouldn't do this". You're right about the latter but wrong about the former.

	▲	embedding-shape an hour ago \| parent [-]
		Yes, contrary to popular belief, even I am affected by context and change what I converse about as the discussions topic and context drift, this is called having a conversation. I'll stand by that I think most Arch Linux users, extrapolated from the people I know also run it, review at least the domain/GitHub organization for random AUR packages, and all of them are aware of what the AUR actually is, and is for. I don't think most people here on HN who are clearly misunderstanding what the AUR is, are actually Arch users, or if they are, they haven't read the header that been visible since forever on the AUR.