today I logged into my mac and opened zsh and had a big shock!

Normally my terminal prompt is something like:

sidharthghoshal@macbook-pro

But today I found it was :

sidharthghoshal@HaeLims-Air

I don’t know what HaeLims-Air is and my first assumption is I had been hacked. Exploring a bit I came across this post: How do I stop my computer name from automatically, and incorrectly, changing? .

Inspired by it I went to the terminal and ran print -P '%m' and it printed out HaeLims-Air so it my hostname %m has legitimately changed.

Now when I check my system preferences and sharing the name of the macbook is still the same as it has ever been. It is Sidharth’s MacBook Pro which is what I thought it should be.

So now I want to ask. How can I find out

1. which files actually contain the string HaeLims-Air that has changed.
2. When did this file change?

I would like to understand exactly when that hostname in the zsh would have been modified. Since this is the first time in my entire life I have encountered this and still feel quite uneasy.

In a weak attempt I tried to run grep -iR "HaeLim" . from the \etc folder but nothing came up.

It is possible this is benign. I looked up my hostname history and indeed there I see that only MOST recently did the host name change:

sidharthghoshal@HaeLims-Air ~ % log show --style syslog --info --last 30d | grep 'setting hostname' 

2024-01-28 16:34:51.391348-0500  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-01-28 16:34:54.493552-0500  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.lan"
2024-01-28 17:39:07.272782-0500  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-01-28 17:39:09.392589-0500  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.lan"
2024-01-31 11:10:27.564345-0500  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-01-31 11:10:37.515435-0500  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.lan"
1969-12-31 19:06:20.379707-0500  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-02 19:00:06.481011-0800  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.attlocal.net"
2024-02-02 19:06:23.604979-0800  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-02 19:06:27.296765-0800  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.attlocal.net"
1969-12-31 20:03:50.582148-0800  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-06 15:50:00.336584-0800  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MBP.attlocal.net"
1969-12-31 16:08:31.806416-0800  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "Sidharths-MacBook-Pro.local"
2024-02-06 22:00:14.072212-0800  localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "HaeLims-Air"

I suspect that the February 06 entry given as

2024-02-06 22:00:14.072212-0800 localhost configd[82]: [com.apple.SystemConfiguration:IPMonitor] setting hostname to "HaeLims-Air"

Actually comes from my Macbook not being turned on since February 06. And thus when it turned on, before the Macbook KNEW what the correct date was it already was attempting to set the hostname. This makes a lot of sense because until the Macbook connects to WIFI I do not believe it has any way of being aware of what the time is. In order to connet to WIFI it will get a hostname assigned.