Polymorphic malware is probably one of the easier things to do with LLMs, so static scanners seem of limited use.

Since this installed a malicious dependency from NPM (and later with bunjs) in the pre install script, it would need at least complex correlation to catch. Maybe building and installing all AUR packages, which would cost far too much for the Arch team.

Individually and automatically scanning only the PKGBUILDs (the stuff actually on the AUR) would likely not have caught this.

That doesn't mean it's a bad idea to run a basic scan over every change, but it wouldn't magically "fix" aur malware.

I wish it was that simple but I doubt there is any scanner that can differentiate between legitimate and malicious code.

Maybe an AI but even then it would probably be quite unreliable.