I updated phpMyAdmin from 4.7.9 to 4.8.0 the day before yesterday. Although they wrote that ‘it is possible to install phpMyAdmin from our own Composer repository.’ on the official download page, I still uses the manually installation in my own way. After updating, I was surprised with a folder named tmp in my phpMyAdmin root directory. But it’s not a malicious but a proper one by phpMyAdmin.