Yup that's partly why I just went to the vendor website before that, I heard about those attacks a week or two ago and removed a lot of my old AUR packages until I figured out what was safe to use. I try to avoid AUR as much as possible now.
Me being a newbie to linux means AUR is a death trap and isn't a viable option for me. I've been learning a lot but sadly I don't know how to program or understand the code yet when reading the PKG Builds to verify if it's not malicious or not. Just the looking for npm or weird downloads part lol
Ideally I would love if I could simply get all my programs from my package manager, but it seems like it's not always that simple and is missing quite a bit of programs on pacman. That's likely why people get viruses from AUR in the first place, since the program they wanted can't be found in pacman, they immediately go running straight to AUR as it's usually just one tab click over on things like cachyos's package manager for example.