When the upstream URL gets updated with the malicious uploaders new URL. There is no warning shown in the process; the only way to check it is to inspect the PKGBUILD manually.