So I turned on my GOS 6a (set to turn off every 8 hours so I can do verified boot). I am running sandboxed Google Play for push notifications for Proton Mail and Signal. I do not have a lot of apps on my phone and every one is FOSS downloaded direct from GitHub. Zero Google except the sandboxed Google suite that comes with GOS for push.
When I turned on the phone there was a drop-down notification from Google Play to uninstall a harmful call blocker app - something I have never installed. It then said "click here" on the drop-down. Needless to say I did not click and swiped to remove the drop-down message.
I have a full-blown stock Android with a ton of Google apps from Google Play and never got something like this on that phone. I really don't see how this could happen outside of one of my GitHub FOSS apps being malicious. I get a little squirrely with stuff like this as I am a vocal activist with local government and police (thus the GOS phone so they can't harvest my info from Google) and they know the phone number of the phone. Any thoughts/suggestions on how this happened otherwise?