I haven't taken a look at the malware, but it seems to download files from the Internet so it should have warned you to allow/deny the outbound connections.

It'd be nice to test it with a sample of aur package/malware.