Even at 1,579 packages listed, that final updated noted, it's a "list containing many (but not all) of the affected packages". Ouch.

https://archlinux.fr/accueil/incident-lie-a-des-paquets-malveillants-aur-actifs

Since sending these files directly is impossible or would trigger security alerts, the threat actors use file-sharing services like TransferNow and WeTransfer, as shown below.

The attackers reportedly used a fake version of KMSPico to infect Windows machines with the Cryptbot malware

https://www.silicon.fr/emotet-demantele-juridique-botnets-406132.html