After the June 2026 Atomic Arch campaign targeted orphaned AUR packages and pushed malicious PKGBUILD changes that pulled credential-stealing payloads, Arch/CachyOS users are debating how much trust AUR helpers should automate. The official guidance remains PKGBUILD/install-script review, but users admit they click through diffs and the warning gives little concrete review help. The opportunity is a default-on safety layer: pnpm-style minimum-release-age/cooldown, a loud alert when a package was just adopted or its maintainer changed, and automated PKGBUILD/install-script scanning.
Don't ship yet another standalone incident scanner. The wedge is a zero-config, default-on paru/yay wrapper (or pacman hook) that hard-pauses installs of versions younger than N days and loudly flags any package whose maintainer or orphan status changed since you last installed it. Those two cheap heuristics map directly to the Atomic Arch failure mode.
landscape (3 existing solutions)
Arch's official 2026-06-12 notice said it was seeing a high volume of malicious AUR package adoptions and updates and continued to tell users to review PKGBUILD and install-script changes. HN/Lemmy users argue that burden is unrealistic: orphaned packages can be adopted, Atomic Arch reporting counted roughly 1,500 affected packages across waves, third-party reporting says a more sophisticated wave appeared 2026-06-14, and AUR signups were disabled Monday 2026-06-15 during cleanup. The pnpm-style minimum-release-age users ask for is documented in pnpm, but the mainstream AUR-helper docs I checked still center on manual review/diffs; incident scanners are reactive against known payloads, not trust-change/cooldown guardrails.