I haven’t heard a peep about the security status of AUR since the headlines about malware injections into thousands of packages. I’ve ensured that none of my installed software is affected by the attack (to the best of my ability), but I’ve held off on my regular yay -Syu since then. What has you all done to keep your machine updated but clean?
And is there any update from AUR maintainers that the situation is under control? Most of my installed AUR packages simply don’t exist in the official Arch repos, so if not I’d have to look for other sources.
I took the incident as a lesson to be more diligent about reviewing the pkgbuild before installing anything. It’s understandable that not everyone will be willing to do that and I think the AUR is probably not for them, at least until there is some sort of safeguard in place.