accountsKeychainExport inside Keychain - malware?

Question

After few months I opened Keychain Access and suddenly there is a new keychain which points to non existing file with path /private/var/folders/14/vvg4hynx6n3dkcv78dll_c5r0000gn/T/accountsKeychainExport~~~JRuSmO/accountsKeychainExport.keychain I open keychain few times a year.

I protect myself with Little Snitch but I run my Mac (10.14.6) with sip disabled (developer here).

I am looking for any explanation/things to check on my system or if I should revoke all my certificates and passwords.

Checked running processes + "launchctl list" and all is clear.

PS: I have recently traveled to China.

Answer 1

Have you recently exported your developer profile using Xcode?

I had a similar (non-existent) keychain entry on my computer, and errors about the missing keychain started appearing in my console on September 21st. It just so happens I setup a CI build agent a few hours before that, so I'm thinking that's the source of my random keychain.

For more definite proof, I just had my friend export his developer profile with Xcode. I checked his Keychain Access before and after the export and can confirm that a new (non-existent) keychain named accountsKeychainExport appeared after exporting his accounts in Xcode. I saw the same result on my laptop as well.

As far as removing the keychain, I've found that simply making the directory and creating an empty file at that location will allow you to remove the keychain with Terminal:

$ security list-keychains
    "/Users/rpendleton/Library/Keychains/login.keychain-db"
    "/path/to/invalid/keychain/folder/accountsKeychainExport.keychain"
    "/Library/Keychains/System.keychain"

$ mkdir -p /path/to/invalid/keychain/folder
$ touch /path/to/invalid/keychain/folder/accountsKeychainExport.keychain
$ security delete-keychain /path/to/invalid/keychain/folder/accountsKeychainExport.keychain