Arch Linux – News: The xz package has been backdoored (archlinux.org)

Unfortunately, in my experience, upgrading Arch rarely goes unpunished. As you’re syncing your whole system with whatever is the lastest (and only the latest) version on the mirror - if something is broken, it is broken. If the mirror is not fully synced and you’re updating then, you may end up upgrading your system to an inconsistent state (one issue I had is that the libc version was incompatible with the libarchive version - consequently breaking pacman).

Unless there were more vectors than the one already described, Arch package was never affected (and if there were more, it's still affected).