is it suddenly using npm to install/run something? (iirc this was the attack vector for most packages that were infected)
suddenly added some weird extra wget/curl/whatever to packaging methods to fetch something weird?
are the package’s sources (eg. github urls) legit?
Generally you should be aware of who’se software you’re installing -> check if it’s downloading the stuff from right place, and nothing extra. The PKGBUILD changes in the aur website are pretty good indicator if something has changed and how.
edit: npm itself, or it’s usage isn’t bad - but it is quite suspicious if the AUR package isn’t for some webapp or so.
as the other commenter said, but worth echoing:
Generally you should be aware of who’se software you’re installing -> check if it’s downloading the stuff from right place, and nothing extra. The PKGBUILD changes in the aur website are pretty good indicator if something has changed and how.
edit: npm itself, or it’s usage isn’t bad - but it is quite suspicious if the AUR package isn’t for some webapp or so.