400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers
(cybersecuritynews.com)
Just because there is an official package doesn't mean someone can't make an aur one with the same name, or with common misspelling.