u/indahkiat

New user, around 1 to 2 months on linux/cachyos. I usually do updates using cachy update. The number of updates on the shelly tray icon is more than cachy update and the drop down menu says these updates are from the AUR. For instance, pacman/cachy update shows that librewolf is updated, but shelly tray icon says there is an update from AUR to a new version for librewolf (i installed from the cachy repo, as checked with pacman -Qi). I have AUR disabled since i don't really use it and have any AUR packages, apart from jacks and heroic, which i did not know were pulled from there (did not explicitly install using shelly or paru).

So is it normal?

I just started using cachyOS a few weeks and so far it's been good, minor annoyance here and there but mostly can be solved.

​

Anyway, I was updating using the cachy updated and noticed two AUR Packages, despite me intentionally avoiding it for now. One was jacks and the other was hero launcher. I did do pacman Q to ger more details and it seemed that the jacks was installed during initial setup (the dates and time match) as a dependency for ffmpeg and heroic was via the cachy games package.

​

I did do a search and found jacks2 was the current one and in the cachy repo and updated, same goes with heroic, uninstalled the aur and installed the pacman version. So I thought it was fine.

​

My question is, now with the AUR malware thing going on, is this a red flag? That jacks was installed from the AUR without me using yay or shelly/package manager? So AUR files can be pulled in as dependents without the users explicit permission? Should I be concerned? I did verify the ISO before installing.

​

Thanks in advance. Jitters of a few weeks old Linux user.