Most of us have pulled something from the AUR because it was faster than packaging it ourselves. You need a tool; it's there, it builds cleanly, and the system keeps moving. No alerts. No obvious red flags. That's usually how supply chain issues begin, not with explosions but with convenience.

Source: New Rust Tool Traur Analyzes Arch Linux AUR Packages for Hidden Risks