WARNING: Global themes and widgets created by 3rd party developers for Plasma can and will run arbitrary code. You are encouraged to exercise extreme caution when using these products

[Duha]

@bedna

I think the warning I get when installing from KDE is enough, both in the window I can download from, big blue text box at top warning me.

That’s enough for you (and me), but times are changing. The developers are aware and they will take action as they think are apropriate. Here is the an excellent blog post by a KDE developer explaining the situation:

Trusting content on the KDE Store

A global theme on the kde third party store had an issue where it executed a script that removed user's data. It wasn't intended as malicious, but a mistake in some shell parsing. It was promptly identified and removed, but not before doing some damage to that user. This is a companion discussion topic for the original entry at http://blog.davidedmundson.co.uk/blog/kde-store-content/

Lets not do too much speculating, I think we will receive further information soon enough.