I think these are primarily people adding new packages, but best to continue due diligence and check the PKGBUILD files diffs for packages you use from the AUR. And for some things you can just get the AppImage from the developer. I like to evaluate who the maintainer is and look through the comments, and for new software packages I haven’t used I’ll look through the whole PKGBUILD file.
https://www.phoronix.com/news/Arch-Linux-AUR-Adoptions-Halted
By Michael Larabel
Last month the Arch Linux User Repository “AUR” saw more than 1,500 malicious packages amid a sophisticated malware attack and then also seeing an influx of spam and profanities amid this community/user-maintained repository for the popular Arch Linux distribution. Unfortunately, there is another round of AUR troubles.
The Arch Linux team announced that due to the current influx of malicious package adoptions, they have decided for now to disable package adoptions in AUR while they handle the situation. They encourage users as well to report suspicious adoption events/comments and to stay vigilant.
There is this mailing list thread outlining AUR malware from yesterday and today. There are dozens of AUR packages this round from i915-sriov-dkms to rtk-git, boringssl-git/hasher, archutil/linter, warp-terminal-git, weather-display, astro-box, and many others.