> I'm actually more surprised that such compromise hasn't happened earlier.

This is like the 3rd or 4th time. It's been ongoing and persistent for the last 2 years with frequent AUR downtime as a result.

The AUR should be deprecated in its current state, simply can't be trusted and is a blemish on an otherwise great distro.