

While you are right in general, you are just creating a file with a <user>:<hashed password> line without any identifying context. So have fun searching the world for where I might have actually used it. Sounds like a really bad use of ressources to create list of passwords.
PS: Yes, as an Arch user I am still pissed that this tool is not available in the repos beside installing the complete Apache server…



People tend to read them the first time when installing stuff, yet rarely think about the scenario of a well used package taken over by a malicious actor making changes.