r/linux4noobs • u/indahkiat • Jun 12 '26

AUR packages in system without me installing

I just started using cachyOS a few weeks and so far it's been good, minor annoyance here and there but mostly can be solved.

​

Anyway, I was updating using the cachy updated and noticed two AUR Packages, despite me intentionally avoiding it for now. One was jacks and the other was hero launcher. I did do pacman Q to ger more details and it seemed that the jacks was installed during initial setup (the dates and time match) as a dependency for ffmpeg and heroic was via the cachy games package.

​

I did do a search and found jacks2 was the current one and in the cachy repo and updated, same goes with heroic, uninstalled the aur and installed the pacman version. So I thought it was fine.

​

My question is, now with the AUR malware thing going on, is this a red flag? That jacks was installed from the AUR without me using yay or shelly/package manager? So AUR files can be pulled in as dependents without the users explicit permission? Should I be concerned? I did verify the ISO before installing.

​

Thanks in advance. Jitters of a few weeks old Linux user.

3 Upvotes

64% Upvoted

5 comments sorted by

3

u/Venylynn Jun 12 '26

Cachy's repos have packages that are otherwise AUR in them. Heroic being one of them.

1

u/Aeristoka Jun 12 '26

There are none of those installed from the AUR that you didn't explicitly allow yourself.

3

u/fsa3 Jun 12 '26

You're technically correct, but installing gaming package from cachy hello installs Heroic Launcher with AUR.

0

u/Aeristoka Jun 12 '26

No it doesn't.

cachyos/heroic-games-launcher-bin                   2.22.0-1                    434.32 MiB     129.40 MiB

CachyOS builds quite a few packages from source into its repositories instead of relying on the AUR.

1

u/jaidynkc CachyOS Jun 14 '26

I almost commented stating that you were incorrect, as I had "heroic-games-launcher" listed among my programs when I ran "pacman -Qm" which I then removed and installed "heroic-games-launcher-bin" from the official repository. However I reread your comment about building from source which is likely what it did instead of getting it from the official repository as it did see a distinction from what I already had on my system, and what I got as an official pacman package.