After the recent attack, I setup aurscan (mentioned in the article) with a locally hosted Gemma model to scan package builds and install files.

Hard to know how well something like this will actually work. So far it’s cleared most updates I’ve thrown at it, with one false positive/warning.