As an Arch user, I am well aware of the potential security issues using AUR. Since AI has become so accessible, the number of malicious packages has skyrocketed. A common attack is to adopt packages as a new maintainer and distribute bundle malware in a new update. This is why it is critical to review pkgbuild files prior to updating packages.
Paru makes this easy, and is my preferred AUR helper. During every update it will have you approve the new pkgbuild file before installation. It is a little more work during updates, but it allows you to see if a package was adopted by a new user or the distribution point has changed.
To provide even more protection, I created a small helper script that wraps Yay/Paru and checks new packages against Aurwatch.org to see if there are any reported malicious code.
AurWatch provides an API that makes it easy to check prior to doing any updates.
For now my aur-safe-update package is only available on Github, but I plan on adding it to Aur soon.
You can find it here: https://github.com/officiallymarky/aur-safe-update
Aur-Safe-Update is only a ~250 line bash script and is easy to review. Usage is really easy, just call it instead of Yay/Paru and it will detect which one you have installed and use the correct one.
