It is a well known risk but not something that was a real risk numerically. I mean, it still isn’t given the number of packages in the AUR.

This is a couple of malicious packages discovered in a short period though. Not a good sign. It was really impact the AUR if polluting it with malware became common.

You should always inspect AUR packages before installing them but few people do. Many would not even know what they were looking at.

The problem is Arch doesnt package everything