"Ready to install" notification for app I don't remember installing

[yump]

I got what appeared to be an update notification for the app ClashMetaForAndroid, but it’s not currently installed and I don’t remember attempting to install it. Reading the info about it, it’s not even entirely clear what it’s for. The Github has a ton of stars and forks, but the userbase seems mostly Chinese (as is the documentation).

Grepping for it in the log, I see:

1683070997249,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_STARTED
1683070997468,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_USER_INTERACTION
1683097652888,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_STARTED
1683097653363,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_USER_INTERACTION
1683120589195,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_STARTED
1683120589627,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_USER_INTERACTION
1683120728574,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_STARTED
1683120728996,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_USER_INTERACTION
1683126694145,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_STARTED
1683126694751,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_USER_INTERACTION
1683126738851,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_STARTED
1683126739067,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_USER_INTERACTION
1683224298246,com.github.metacubex.clash.meta,207004,org.fdroid.fdroid.installer.Installer.action.INSTALL_INTERRUPTED

The last one, I think, is when I accidentally invoked the install flow by tapping the notification, and the install failed.

Any idea what’s going on here? Did I accidentally do this while half-asleep? Does this indicate a malware infection that has tripped over its own foot somehow?

[SkewedZeppelin]

are you sure you didn’t mistap install on it while scroll around the app?

(it is a proxy app)

if malware is running there are far easier way to run more malware than kindly ask F-Droid and the user to do it.

[yump]

I haven’t been browsing for apps recently, and I probably wouldn’t’ve looked at that one. However, I just tested installing a different app, and apparently if you press back before the download finishes, the app appears in the update list.

It’s not impossible that I opened F-droid to check for updates, accidentally clicked on it from the “latest” tab, fat-fingered the install button, then pressed back and never realized until I saw the notification.

The reason I thought malware might want to do that is that it could possibly get more permissions by tricking the user into installing something.