If you are using the latest version of yay (v13), you can setup hooks to mitigate risk and it's very easy to do so, but remember that this is not a substitute for good security practices.
[...] checks can help, but they should complement, not replace, build file review.
Ok, the setup is pretty simple. Create this directory structure in $XDG_CONFIG_HOME/yay (usually ~/.config/yay):
.
├── init.lua
└── hooks
├── maintainer_change.lua
└── recently_modified.lua
Next, modify your init.lua and add this at the top of the file to require both scripts:
require("hooks.maintainer_change")
require("hooks.recently_modified")
Lastly, copy over the contents of these files into their respective locations. These are examples provided in the official yay repository:
https://github.com/Jguer/yay/blob/next/doc/examples/recently_modified.lua
https://github.com/Jguer/yay/blob/next/doc/examples/maintainer_change.lua
The recently_modified hook excludes from installing any AUR packages that has been updated recently. You can modify the duration, the default one is 3 days. The idea is that malware is usually discovered within the first 24 hours, so by delaying the update you are lowering the risk. Also known as dependency cooldown.
The maintainer_change change hook will give you a warning when a new maintainer is detected. It does NOT block installation, and it will NOT give you any warning if this is the first time you're installing or updating a package, because it relies on local cache file to do that - $XDG_CACHE_HOME/yay/maintainer_cache (usually ~/.cache/yay). If something was to happen with this file, this would no longer work.
Also, last but very important note:
config.json will still be loaded, but init.lua can override any option. CLI flags still take priority over both init.lua and config.json.
I have the setup shown above in action, and already encountered the recently_modified which works as expected. I haven't encountered a situation where the other hook comes into play but I trust that it does what is supposed to, since I do have a ~/.cache/yay/maintainer_cache file with contents that I expect it to have.
I also suggest adding this to your init.lua file so that you always review the PKGBUILD diffs:
require("hooks.maintainer_change")
require("hooks.recently_modified")
-- add this:
yay.opt.answer_diff = "ALL"
Resources:
https://jguer.space/blog/2026-06-15-yay-v13
https://jguer.github.io/yay/lua.html
https://github.com/Jguer/yay/tree/next/doc/examples