150
Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware
(www.phoronix.com)
This is a most excellent place for technology news and articles.
Highly likely, actually. SteamOS is Arch-based, and if a user installs things through the AUR on their deck (like a password manager or a VPN that isn't part of the official upstream repo), then it would be infected exactly the same as any other Arch-derived OS.