It is not likely that this malware is picked up through F-Droid as that 'store' only contains software which was built from source by the store maintainers. Any

It is not likely that this malware is picked up through F-Droid as that 'store' only contains software which was built from source by the store maintainers. Any non-free code is removed from the build before the package is hosted on the download server. As such an Android device can be used (in a useful way) without having Google Play services (or, for that matter, any other Google apps) installed. I've been doing just that for more than 5 years now without having the feeling I'm missing out on something. AOSP or a tailor-made Cyanogenmod (with all the Cyanogen-account related stuff removed) plus F-Droid gives you a perfectly usable device. https://f-droid.org/about/ https://f-droid.org/about/