CSF/LFD constantly flags Scalar-List-Utils as suspicious

Greg M

Well-Known Member
May 26, 2016
Glasgow, Scotland
cPanel Access Level
Root Administrator
Hi all

Been having this 'issue' for a quite a while which is this:

Time: Mon May 14 00:05:02 2018 +0100
File: /tmp/.cpan/build/Scalar-List-Utils-1.48-z7HNEF/t/readonly.t
Reason: Script, starts with #!
Owner: :cpaneldemo (1000:1000)
Action: No action taken

some other "suspicious files"

File: /tmp/.cpan/build/Scalar-List-Utils-1.48-z7HNEF/t/getmagic-once.t
File: /tmp/.cpan/build/Scalar-List-Utils-1.48-z7HNEF/t/refaddr.t
File: /tmp/.cpan/build/Scalar-List-Utils-1.48-z7HNEF/t/weak.t
File: /tmp/.cpan/build/Scalar-List-Utils-1.48-z7HNEF/t/dualvar.t

-And so on

Does anyone know why this is happening? I only see this issue on this server and I couldn't find anything else online about this either. What exactly are the Scalar List Utils, what do they do? Do I even need them? All I found online is that its for Perl and provides extra functions or something.

I get about 50 notifications a day, every day. So it's getting quite silly now.

The server is a Dedicated Xeon E3-1270 V2 - 32GB RAM Centos 7.5 standard - And just upgraded to cPanel v70 (had this issue before v70 aswell)

I'd appreciate any information on this


Staff member
Apr 11, 2011
Hello @Greg M,

Those look like Perl modules. You'd generally see this in the /home/.cpan directory. You can check to see if your default CPAN directory is set to /tmp using the instructions from the following StackOverflow thread:

fixing cpan by resetting it

Here are some additional threads where the topic of excluding files from the LFD suspicious process list is discussed:

LFD Notice of Suspicious Process
Suspicious process running under user
Suspicious process running under
lfd suspicious process /usr/bin/php

Thank you.