It silently checks for updates in the background and I can't see this documented anywhere.

1. Why does it need to check for updates? this activity appears as a random internet connection where none was expected and gives off a spyware vibe (I know it's not, but that's the vibe it gives off).

2. Why isn't this documented anywhere (that I can find)?

3. How do I disable it?

Note: I didn't install the package manually, it came as dependency of other packages.

IMO, it should not be checking for updates by default, or at least not when the package is obviously not installed globally (which is a bad practice IMO).