The Arch User Repository is not a problem

Anyone can make a package for the Arch User Repository and others can install it. There's no verification, otherwise it would be pointless, and you need to trust the person who packages it. You'll review the scripts and files and make sure it comes from a trusted source, and if the package updates you review the changes. Has the package added new dependencies that make no sense? Don't install it…