That sort of attack would need to take one of two forms: 1) Hijacking an already-approved application 2) Creating a forked/new fraudulent application and subm

That sort of attack would need to take one of two forms: 1) Hijacking an already-approved application 2) Creating a forked/new fraudulent application and submitting it to the store Option 1 requires you to fool the repository owner, first of all. That would mean submitting a pull-request with your malicious code, having that malicious code reviewed by the app author, and then getting it into a major release. In most apps with a significant userbase that's nigh-unimaginable; especially if there are testers or multiple contributors testing and debugging on recent builds. Option 2 requires you to fool the F-Droid admins. This means one of two things. Either creating a forked application with plausible yet distinct features that make it necessary to be forked from the main project. Alternatively, you get ChatGPT (or just copy boilerplate ffs) and make a calculator app or whatever, commit it all to Github and send it in for review. Both of these routes are horribly suspicious - a reviewer is going to want to see if you have multiple contributors, a long history on Github, linked social media accounts or websites, other repositories, binary blobs, that sort of stuff. Maybe they aren't the most cautious, but suffice to say anyone making an attack like this is going to be covered in red flags. So; it's a feasible attack. But it requires so much social manipulation for so little feasible gain (especially when F-Droid wasn't even auto-updating for most people) that it's not worth the effort. If you do manage such a daring attack, your reward is maybe 300-odd sideloading users that mistakenly clicked your install button instead of the other guy's.