The strongswan installation itself doesn’t seem to be malicous.

It looks like these packages were installed via the apt repositories: strongswan-starter
strongswan-libcharon
strongswan-charon
libstrongswan

This is crazy. Can someone reproduce this behaviour?

No. I had Manjoro for some time and then Linux Mint as daily driver. But nowadays I use Linux exclusively on the server side privately and professionally.