400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers
(cybersecuritynews.com)
Sorry if I was unclear. You usually don't inspect the install scripts for official packages since you put the trust in the official team. You don't trust(or at least shouldn't) AUR packages, hence you should inspect the install script for those packages. I don't really see what the alternative would be.