Dear Community and KDE,
I just installed this Global Theme, innocently (Global Themes -> Add New...):
https://preview.redd.it/q66u1i48bdpc1.png?width=367&format=png&auto=webp&s=91e5dafcff6308ee63825996d7bc3b6e1f23535f
It DELETES all your USER mounted drives data. It executes rm -rf on your behalf, deletes all personal data immediately. No questions asked.
I'd appreciate it if anyone could escalate this, I find it totally mind blowing that installing skins allow script execution so easily. I cancelled this when it asked for my root password, but it was too late for my personal data. All drives mounted under my user were gone, down to 0 bytes, games, configurations, browser data, home folder, all gone.
As per OpenSUSE Reddit users, they indicated that this plasmoid executes rm functions (see https://www.reddit.com/r/openSUSE/comments/1biunsl/hacked\_installed\_a\_global\_theme\_it\_erased\_all\_my/)
Please investigate and escalate :) - I'll be busy reinstalling all my system from scratch, restoring data to go back to work.
UPDATE: Really wanted to appreciate the community for the response and overall reactions of developers. Remember to backup important data, and keep in mind we are all part of making these systems better, as I felt well to be able to share this and be heard. In any OS us users authorize programs to execute things on our behalf, so remember always to run trusted software! I can't confirm whether this was malicious, to my understanding it was just a compatibility and programmers mistake gone south. Looking forward to what this brings in unmoderated community content management.
