It wasn’t removed, it was marked as orphaned, which means anyone can take over and mess with it, lowering the bar for supply chain attacks.

If another user had said “I can take care of this long-term, gimme”, I’d had handed it over. Instead, some self-important dingbat with too many privileges decided to mass-mark all packages with an “outdated” flag beyond a certain age as orphaned, then ignored my mailing list post.

For what it’s worth, a distro package maintainer’s inability to update a package to a newer upstream version does not necessarily lead to a package being removed. Debian and Ubuntu kept shipping an ancient version of freetds sometime in the mid-2010s and the package maintainer was incommunicado.

A couple of weeks ago, some dingbat of an AUR admin orphaned a package of mine, ignoring the comment I left on it and my post to the mailing list.

Even though this package, to my knowledge, didn’t end up being attacked, I wonder if this was a potential precursor to the recent attack…