On the back of the recent aur malware infestation I decided to remove all aur apps from my system. Having done this I was surprised to see that following my next update, using yay, a new aur app had been installed. I removed it manually straight away and don’t recall the name, but I would have thought that on a system with no aur apps, a call to yay would not install any new apps, only update existing.
Please can someone educate my on my misunderstanding?
It might be remnant orphan package, leftover after removing the explicitly installed packages?
Try running this to clean up any orphan packages:
yay -Yc
To clarify, this isn’t referring to AUR orphan packages (no maintainer), rather dependencies on your system that are no longer connected to any installed package.
yay is an AUR helper so yes it will install/update AUR packages.
If you don’t want any AUR use pacman instead of yay
What does pacman -Qm show?
…or, should someone insist on using yay over pacman, simply EXCLUDE the AUR packages ,
Personally, I find writing the 3-letter-word “yay” PLUS (a) random number(s) a lot lazier than “sudo pacman -Syu”.
*** On the safe grounds that yay is in the Endeavour repo.
yay won’t install new packages from AUR during an update if you don’t have any other AUR packages installed. It is probably a repo package that was removed from the repos but is now in AUR.
If you don’t want any AUR packages, you should use pacman instead of yay