The AUR on SakuraOS
The Arch User Repository is why you can install almost anything on Arch without hunting for a package. It is also build scripts written by other users that nobody reviews. SakuraOS ships it turned off, and gives you two different things to lean on once you turn it on.
Off by default, one checkbox away
A fresh install has the AUR disabled, because you have not agreed to run unreviewed code from strangers yet and nobody asked you. Turning it on is one checkbox in System Settings. It is not hidden behind a configuration file or a wiki page, and nothing nags you about it afterwards.
Two safeguards that face opposite directions
These are frequently confused, and the difference is the entire point.
The campaign check faces backwards
When the AUR is used to ship malware, the affected packages, the files they drop and the services they install get published afterwards. The campaign check compares what you have installed against those published lists, on a timer and whenever something new is installed.
It answers one question: am I holding something from a campaign somebody has already reported? Exact matches, not guesswork.
It is not a malware scanner. It cannot say anything about a package nobody has reported yet, and describing it as antivirus would be a lie that gets somebody hurt. A build script is arbitrary code, and no tool can prove arbitrary code is safe.
The review faces forwards
Before a package builds, the store shows you what the script actually does: the build script itself, what changed since the version you last accepted, and the signals that tend to matter. A maintainer who changed last week. A package adopted three days ago. A download that is not coming from the project's own servers.
That is the half that can catch something nobody has reported. It needs you to read it, which is why the diff is shown rather than a verdict.
Between them: the check catches what is known, and the review is how you catch what is not yet. Anyone promising a single check that catches everything is selling you something.
Where the campaign lists come from
The checking tool is lenucksi/aur-malware-check, GPL-3.0, installed unmodified so it can be diffed against upstream without unpicking our packaging.
It is pinned by commit rather than by tag. At the time of packaging the
v3.0.0 tag was 66 commits behind master, and for a
tool whose entire job is integrity, a moving branch is not a dependency, it
is a hole. Moving the pin is a deliberate act that involves reading the diff.
AUR updates
AUR packages are never updated automatically. The nightly update run covers repository packages, Flatpaks and Snaps. It does not rebuild anything from the AUR. A package you installed from there stays at the version you built until you rebuild it yourself.
They are now reported: the store checks the AUR for newer versions of what you have and lists them for review, alongside the build script diff since the version you last accepted. Applying one is still your decision and always will be, because it means running somebody else's code.
The guard still applies
An AUR helper is still pacman underneath, so the removal check inside pacman applies to it exactly as it does to anything else. See Terminal Assist.