Sounds like they were easily detected and removed.

I’m guessing this was just for build scripts for Paru and Yay in the AUR? Like if you’re cloning the git repository and making the package yourself you wouldn’t be affected?