I'm spending a lot of my time removing AUR packages for alternatives in the official Archlinux repositories.

I've shifted from Dropbox to RClone, from acpilight to brightnessctl, from spotify to spotify-launcher and so on.

Has anyone else having the same trust problem? Also, how do you stay updated with the situation?

I work in a corporate environment and malware is a no-go.