> I'm actually more surprised that such compromise hasn't happened earlier.

This is like the 3rd or 4th time. It's been ongoing and persistent for the last 2 years with frequent AUR downtime as a result.

The AUR should be deprecated in its current state, simply can't be trusted and is a blemish on an otherwise great distro.

I have long thought that fewer things get properly packaged for Arch due to it having the AUR as a crutch. Stuff like Void and Guix will have packages that are only in the AUR for Arch.