The Arch Wiki does note that malware has made it into the AUR several times before.