This is one of the aspects of AUR which never fully convinced me: it purely hosts user-generated content, there's no review process or alike.

I'd really prefer to see a model where a 'community' repository contains user submitted packages which have at least one Trusted User review the package before it's merged in. This doesn't just prevent malware, but also common mistakes in general.