for what it's worth, I knew that AUR could be used to distribute malware when I last used Arch... in 2014 (yes, this was a problem 12 years ago!).
I know people will hate me for saying this, but AUR was never safe. It was one of two reasons why I ditched Arch (another reason was stability... or rather lack thereof, although I've heard it improved over the past decade)
