Here is how I did it :
Get a list of installed packages originating from AUR using 'yay' :
yay -Qam > packages_aur.last
Get list from https://md.archlinux.org/s/SxbqukK6IA# : curl https://md.archlinux.org/s/SxbqukK6IA/download > compromised.txt
then : grep -wFf compromised.txt packages_aur.last
should spit out the packages that are in both files, hence were compromised at some point, I guess.