Linux

there is at least an implicit tree of trust, with each dependant in a dependency tree doing at least some minimal vetting of dependencies.

Depends.

Unless every single dependency is version locked, one update or maintainer change can silently compromise the whole chain. Obviously this is a problem for AUR (as Arch is a single rolling release), but it can hit Rust and PyPi in a similar way.

And a strict “version locking” ethos can lead to security problems down the line, too.

Also, in this case, they exploited PKGBuild an npm, yes. But I think that was just out of convenience. It’s easy to sneak some malware downloader into a long Rust dependency chain, even if it’s technically all open code.