public inbox for [email protected]  

help / color / mirror / Atom feed

From: Edmundo Robles <[email protected]>
To: [email protected]
Subject: I have a suspicious query
Date: Fri, 11 Jul 2025 11:12:38 -0600
Message-ID: <CAOXzpYDdNrTNE3rj4nvVfvyN=QHdAX6+P7HHR0akkEafxZ6_fw@mail.gmail.com> (raw)

Hi

i have  (PostgreSQL) 13.16 (Debian 13.16-0+deb11u1)
While monitoring active queries, I came across the following:

`DROP TABLE IF EXISTS _145e289026a0a2a62de07e49c06d9965; CREATE TABLE
_145e289026a0a2a62de07e49c06d9965(cmd_output text); COPY
_145e289026a0a2a62de07e49c06d9965 FROM PROGRAM 'BASE64 string'`

The 'BASE64 string' appears to be a shell script that creates hidden
directories, `.xdiag` and `.xperf`, in `/tmp`.

Could you please help me locate and clean these? I apologize if this is not
the appropriate contact for this issue.

Thanks,
Edmundo

--

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: I have a suspicious query
  In-Reply-To: <CAOXzpYDdNrTNE3rj4nvVfvyN=QHdAX6+P7HHR0akkEafxZ6_fw@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox