On startup, firstaidkit creates a /tmp/firstaidkitbackup directory. This is then vulnerable to malicious processes creating a directory with the same name.
commit 51a175634d24eec42ad5a7cbe23660b42a63470c fixes this.