That link in the OP is clouding my judgement if the link is safe or not.

Man, that’s a lot of python.

EDIT: No, sorry, I misread the article. The commits were made to a large number of packages, alvr was just one of many.

If I’m not mistaken users can simply type “pacman -Q | grep alvr” and if there are no results or the result is before the update then they’re good? Also check to make sure the command works with something like “pacman -Q | grep curl” or other package you know is installed.