Arch Linux user repository altered to host malware, Arch maintainers say they're "surprised it doesn't happen more often".