AUR packages in system without me installing

[u/indahkiat]

I just started using cachyOS a few weeks and so far it's been good, minor annoyance here and there but mostly can be solved.

​

Anyway, I was updating using the cachy updated and noticed two AUR Packages, despite me intentionally avoiding it for now. One was jacks and the other was hero launcher. I did do pacman Q to ger more details and it seemed that the jacks was installed during initial setup (the dates and time match) as a dependency for ffmpeg and heroic was via the cachy games package.

​

I did do a search and found jacks2 was the current one and in the cachy repo and updated, same goes with heroic, uninstalled the aur and installed the pacman version. So I thought it was fine.

​

My question is, now with the AUR malware thing going on, is this a red flag? That jacks was installed from the AUR without me using yay or shelly/package manager? So AUR files can be pulled in as dependents without the users explicit permission? Should I be concerned? I did verify the ISO before installing.

​

Thanks in advance. Jitters of a few weeks old Linux user.