chkrootkit

Some false positives documented below.

Suspicious files and directories

/usr/lib/libreoffice/share/.registry

Installed from libreoffice-common.

/usr/lib/jvm/.java-1.17.0-openjdk-armhf.jinfo

Installed from openjdk-17-jre-headless.

.lgd-nfy0

Created by pinout (at least). See Consider different/configurable name and location for .lgd-nfyx pipes & Write .lgd-nfy file to tmp?.

/usr/lib/python3/dist-packages/matplotlib/...

• /usr/lib/python3/dist-packages/matplotlib/backends/web_backend/.{eslintrc.js,prettier{rc,ignore}}
• /usr/lib/python3/dist-packages/matplotlib/tests/{tinypages/{.gitignore,_static/.gitignore},baseline_images/.keep}

Installed from python3-matplotlib.

/usr/lib/python3/dist-packages/numpy/...

/usr/lib/python3/dist-packages/numpy/{core/include/numpy/.doxyfile,f2py/tests/src/{f2cmap/.f2py_f2cmap,assumed_shape/.f2py_f2cmap}}

Installed from python3-numpy.

/usr/lib/debug/.build-id

Installed from libc6-dbg.

/usr/lib/ruby/gems/3.1.0/gems/typeprof-0.21.2/vscode/...

/usr/lib/ruby/gems/3.1.0/gems/typeprof-0.21.2/vscode/.{gitignore,vscodeignore,vscode}

Installed from libruby3.1.

/usr/lib/ruby/vendor_ruby/rubygems/...

/usr/lib/ruby/vendor_ruby/rubygems/{optparse/.document,ssl_certs/.document,tsort/.document}

Installed from ruby-rubygems.

/usr/lib/pypy/lib_pypy/ctypes_config_cache/.empty

Installed from pypy-lib.