By complete chance yesterday I decided to manually update my apps - I normally just let them go whenever in the background

I happened to run into this! Having not actually used Termux in months... I just removed it.

Yet another retroactive Trojan horse, huh? A play at monetizing a conflated name. This garbage is why I don't engage with the ecosystem any more than required