With the AUR and PPAs, random members of the community that weren't involved with developing the original software can submit software. This means you can't go

With the AUR and PPAs, random members of the community that weren't involved with developing the original software can submit software. This means you can't go off of the software's reputation alone, as someone may have uploaded a malicious version of existing software (i.e. what happened around a month ago on the Ubuntu Snap store with a malicious Bitcoin wallet: https://popey.com/blog/2024/02/exodus-bitcoin-wallet-490k-swindle/ https://popey.com/blog/2024/02/exodus-bitcoin-wallet-490k-sw...). I do agree that themes don't sound like they could execute code, and KDE should be doing more to restrict what they can do to a user's computer.