Is this a security risk?

I have run FNDB update many times over many years of using MiKTeX.  I do
not recall it ever telling me I have to install a new package, until now.
Now it will not run without me installing the bagpipe music package.

Is that requirement actually coming from MiKTeX or has someone broken into
the system to get some unwanted software in?

The same question was posted on
http://tex.stackexchange.com/questions/192311/music-tex-needed-after-package-update
last July, where it has gotten no answer.

best, Colin
------------------------------------------------------------------------------