MIME-Version: 1.0
From: Edmundo Robles <edmundo@sw-argos.com>
Date: Fri, 11 Jul 2025 11:12:38 -0600
Message-ID: <CAOXzpYDdNrTNE3rj4nvVfvyN=QHdAX6+P7HHR0akkEafxZ6_fw@mail.gmail.com>
Subject: I have a suspicious query
To: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="0000000000004cd0630639aa6c08"
Archived-At: <https://www.postgresql.org/message-id/CAOXzpYDdNrTNE3rj4nvVfvyN%3DQHdAX6%2BP7HHR0akkEafxZ6_fw%40mail.gmail.com>
Precedence: bulk

--0000000000004cd0630639aa6c08
Content-Type: text/plain; charset="UTF-8"

Hi

i have  (PostgreSQL) 13.16 (Debian 13.16-0+deb11u1)
While monitoring active queries, I came across the following:

`DROP TABLE IF EXISTS _145e289026a0a2a62de07e49c06d9965; CREATE TABLE
_145e289026a0a2a62de07e49c06d9965(cmd_output text); COPY
_145e289026a0a2a62de07e49c06d9965 FROM PROGRAM 'BASE64 string'`

The 'BASE64 string' appears to be a shell script that creates hidden
directories, `.xdiag` and `.xperf`, in `/tmp`.

Could you please help me locate and clean these? I apologize if this is not
the appropriate contact for this issue.

Thanks,
Edmundo

--

--0000000000004cd0630639aa6c08
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div></div><div>Hi=C2=A0</div><div><br></=
div><div>i have=C2=A0 (PostgreSQL) 13.16 (Debian 13.16-0+deb11u1)</div><div=
>While monitoring active queries, I came across the following:</div><div><b=
r></div><div>`DROP TABLE IF EXISTS _145e289026a0a2a62de07e49c06d9965; CREAT=
E TABLE _145e289026a0a2a62de07e49c06d9965(cmd_output text); COPY _145e28902=
6a0a2a62de07e49c06d9965 FROM PROGRAM &#39;BASE64 string&#39;`</div><div><br=
></div><div>The &#39;BASE64 string&#39; appears to be a shell script that c=
reates hidden directories, `.xdiag` and `.xperf`, in `/tmp`.</div><div><br>=
</div><div>Could you please help me locate and clean these? I apologize if =
this is not the appropriate contact for this issue.</div><div><br></div><di=
v>Thanks,</div><div>Edmundo</div><div><br></div><span class=3D"gmail_signat=
ure_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature" data-s=
martmail=3D"gmail_signature"><div dir=3D"ltr"><img width=3D"420" height=3D"=
140" src=3D"https://ci3.googleusercontent.com/mail-sig/AIorK4y8vGOwKR1HLl8O=
acHvpmFtLxiMWxu3RTwJkNc194R7L3y8vNwGs9CZ_eT2wJb8wKLbxHsU4By4ssRV"><br><div>=
<br></div></div></div></div>
</div>

--0000000000004cd0630639aa6c08--