To answer your question, generally yes the package maintainer is the one who maintains the package for the current version of the distro, even if upstream is unchanged. If a package is no longer compatible and no one is making it compatible, then yes it’s unmaintained and should be removed.
A couple of weeks ago, some dingbat of an AUR admin orphaned a package of mine, ignoring the comment I left on it and my post to the mailing list.
Even though this package, to my knowledge, didn’t end up being attacked, I wonder if this was a potential precursor to the recent attack…
To answer your question, generally yes the package maintainer is the one who maintains the package for the current version of the distro, even if upstream is unchanged. If a package is no longer compatible and no one is making it compatible, then yes it’s unmaintained and should be removed.
It wasn’t removed, it was marked as orphaned, which means anyone can take over and mess with it.
If another user had said “I can take care of this long-term, gimme”, I’d had handed it over.
I wonder if that AUR admin’s orphaning spree played a role in enabling this attack.