The strongswan installation itself doesn’t seem to be malicous.

It looks like these packages were installed via the apt repositories: strongswan-starter
strongswan-libcharon
strongswan-charon
libstrongswan

This is crazy. Can someone reproduce this behaviour?

No. I had Manjoro for some time and then Linux Mint as daily driver. But nowadays I use Linux exclusively on the server side privately and professionally.

The fact is that there is some useful info that only is on Reddit.

I mean reddit has become a insanely huge knowledge base for all sorts of technical problems and other topics. I’ve searched with site:reddit.com so many times for problem solving.

Muscle memory is also hard to break. I had to remove Apollo from my homescreen :D