Currently you can use https://github.com/lenucksi/aur-malware-check to do a check if you’re infected. My main server was safe, still haven’t tested on my wayland machine though, I went yolo with that one. No important keys at least are there.

I don’t use arch, btw.

This must be fake news because several hundred people told me there is no malware on Linux.

They should have some sort of static code scanners on the repos at rest at this point that look for certain patterns and issue warnings.