Comment by naturalmovement

Uh but this isn't random git repos these are packages available through the OS's repos. Why does the AUR even exist if not for malware distribution?

It's an uncontrolled free-for-all disguised as a watering hole. If they can't do the most basic of housekeeping it should not exist full stop.