On: Arch Linux AUR Repository Found to Contain Malware

[arendtio]

I wonder how other distributions solve that situation.

[blfr → arendtio]

By being popular enough to have providers package the software for them. For example, Chrome is available from a repo maintained by Google itself.

https://www.google.com/linuxrepositories/

OTOH, you're basically giving Google root access to your machine.

[Hello71 → arendtio]

Either ignore them (Ubuntu) or they just don't. For many years Debian and Fedora didn't have MP3 decoder installed by default.

[Foxboron → arendtio]

Distributing them as repackaged binaries would be against the terms. I'm unsure what distros ignores the terms and packages them anyway. It is a clear liability for any larger distributions at least.