Thinking about this, as an AUR user I'm used to watching the build process abstractly flow by as you run updates. Adding the malware injection during build would probably get noticed a lot more/quicker as they were adding calls to run npm - builds would either fail (no npm installed, me) or they'd start sucking down unexpected artifacts (why is this python module doing npm things). Injecting it in the post-install logic hides it, where failures can be ignored.