Only an installer on pear.php.net was compromised. I think a "proper" package would be built from the source code, bypassing that installer. But a more ad hoc

Only an installer on pear.php.net was compromised. I think a "proper" package would be built from the source code, bypassing that installer. But a more ad hoc package, like from Arch's AUR, might just fetch that installer from pear.php.net instead. In fact, that's what the AUR package did - it just hardcodes the URL of the installer. The AUR package was (probably) not compromised, but perhaps only because it happened to use the nozlib version of the installer instead of the version that was compromised. This is how the AUR package looked at the time: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=php-pear&id=54f5f3e0ce9c6a13c6ecc3f708c4128e97ce1e4e https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=php-p... And this is how it looks now: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=php-pear https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=php-p... The old PKGBUILD does have a hash, but I don't know if it was obtained from a trusted source. So I would guess that if it had used the compromised installer, and the installer was compromised after the PKGBUILD was updated to use that release, it would have alerted people that the installer had been replaced. The new PKGBUILD uses the Github release and includes a PGP key.