A local attacker can exploit an issue in the manjaro-update-system.sh script to install or remove arbitrary packages and package repositories. These repositories can contain hooks with arbitrary code that will automatically be run as root. Additionally, an attacker can remove vital system packages.