ls -l /usr/local
Are /etc and /sbin carrying user 1012 with date of last update Oct 24 and overnight update check?
ls -l /usr/local/etc
ls -l /usr/local/etc/netatalk
Are netatlk and uams under same user 1012 ?
My users typically begin at 1001 so there as a bit of panic seeing owner:group on those system files as
jimbob:1012
I checked another and it has 1012:1012 so I’m fairly sure it’ s not malicious activity, just wanting to have someone else confirm.
[~] # head -n7 /etc/config/uLinux.conf
[System]
Model = TS-X51
Internal Model = TS-X51
Server comment =
Version = 5.2.7
Build Number = 20251024
Number = 3297
[~] # ls -l /usr/local
total 0
lrwxrwxrwx 1 admin administrators 19 2025-12-02 12:45 apache -> /mnt/ext/opt/apache/
drwxr-xr-x 2 admin administrators 2240 2025-12-02 12:46 bin/
drwxr-xr-x 4 1012 1012 80 2025-10-24 15:13 etc/
drwxrwxrwx 3 admin administrators 60 2025-12-02 12:46 fs/
drwxr-xr-x 3 admin administrators 80 2025-12-02 12:43 include/
drwxr-xr-x 3 admin administrators 60 2025-10-24 16:37 lan/
drwxr-xr-x 5 admin administrators 2440 2025-12-02 12:45 lib/
drwxr-xr-x 3 admin administrators 60 2025-10-24 14:02 lib64/
lrwxrwxrwx 1 admin administrators 20 2025-12-02 12:43 mariadb -> /mnt/ext/opt/mariadb/
lrwxrwxrwx 1 admin administrators 58 2025-12-02 12:45 medialibrary -> /share/CACHEDEV1_DATA/.qpkg/MultimediaConsole/medialibrary/
lrwxrwxrwx 1 admin administrators 31 2025-12-02 22:41 modules -> ../..//lib/modules/5.10.60-qnap/
drwxr-xr-x 30 admin administrators 760 2025-10-24 14:51 network/
drwxr-xr-x 3 admin administrators 60 2025-12-02 12:43 Python3/
drwxr-xr-x 4 admin administrators 80 2025-10-24 15:27 qmigrate/
lrwxrwxrwx 1 admin administrators 18 2025-12-02 12:43 samba -> /mnt/ext/opt/samba/
drwxr-xr-x 3 1012 1012 1800 2025-12-02 12:46 sbin/
drwxr-xr-x 3 admin administrators 120 2025-10-24 16:38 share/
drwxr-xr-x 2 admin administrators 1900 2025-10-24 15:27 sys_sound/
drwxr-xr-x 7 admin administrators 140 2025-10-24 15:14 ups/
[~] # ls -l /usr/local/etc
total 0
drwxr-xr-x 3 1012 1012 180 2012-10-17 22:14 netatalk/
drwxr-xr-x 3 admin administrators 60 2025-10-24 15:13 snmp/
[~] # ls -l /usr/local/etc/netatalk/
total 32
-rw-r--r-- 1 admin administrators 11256 2011-03-03 15:24 afpd.conf
-rw-r--r-- 1 admin administrators 5009 2005-09-23 16:56 AppleVolumes.default
-rw-r--r-- 1 admin administrators 0 2012-10-17 22:14 AppleVolumes.system
-rw-r--r-- 1 admin administrators 1059 2004-09-17 17:21 atalkd.conf
-rw-r--r-- 1 admin administrators 1016 2005-11-14 21:05 netatalk.conf
-rw-r--r-- 1 admin administrators 1479 2004-09-17 17:21 papd.conf
drwxr-xr-x 2 1012 1012 200 2025-10-24 15:28 uams/
[~] # cat /etc/passwd
admin:x:0:0:administrator:/share/homes/admin:/bin/sh
guest:x:65534:65534:guest:/tmp:/bin/sh
httpdusr:x:99:0:Apache httpd user:/tmp:/bin/sh
[sshd]:x:110:65534:SSHD Privilege Separation:/var/empty:/bin/sh
onecd:x:1000:100:Linux User,,,:/share/homes/onecd:/bin/sh
[~] # cat /etc/group
administrators:x:0:admin
everyone:x:100:admin,onecd
guest:x:65534:guest
Looks fine. 
THANK YOU 
Much appreciated that you took the time to help allay the fear!.
Thanks for your report!