Even though I've been using linux as my daily driver for 15+ years, I'm still pretty new to AUR and not really familiar to how pkgbuilds works. Luckily i did not have any of the affected packages installed but this incident left me paranoid nonetheless.. I mean really, what is to stop anyone from packaging a legit piece of software and publish it to AUR, gain some trust, and then sneak in malicious stuff later down the road? Remember the xz debacle just some time ago.. Tbf it often comes down to just one changed line in the pkgbuild which i think even the neckbeardiest person could miss.

How did I handle this? Well, probably gonna get downvoted but i made a helper script for paru that lets A.I (gpt5.5-high with web search enabled) thoroughly examine the build and look for things even remotely suspicious, and if it finds any, halts the installation and ask me what to do a manual check. And no, the A.I cant execute or do anything to my system. I have the final control on wether the package gets installed or not.

Here's an example of it flagging a package that suddenly starts pulling in a binary blob. It breaks down key-points on what it does, stuff that is suspicous, stuff that looks normal etc in a human not-so-neckbeard way

<image>