It looks like they were existing packages.

List here: https://cscs.pastes.sh/raw/aurvulnlist20260611.txt

Got that from: https://discuss.cachyos.org/t/aur-compromised-1500-packages-affected-20260611/31040
They have a script that can check if you have any of them.