by the looks of it I think it’s nothing to worry about (.gitkeep, composer/*, .php-cs-fixer*, psalm.xml … they seem to be development files or files created at build time).
The error reports that it has found that some of the files are not listed in the app signature.json file (the one that is checked to control app file integrity).
Manually downloading latest version of one of the apps I checked some of the reported files are indeed in the signature.json and therefore should not be reporting it as EXTRA_FILE
First step would be to update the apps (if any update available) and trigger a file integrity check rescan. If no updates…
Maybe not for twofactor_totp, but for the other apps you can try to uninstall them (list/note down the remaining files in the app directory) and reinstall them, refresh the integrity check message if needed and verify what it is reporting. Maybe not possible to do (just disable/enalbe) for bruteforcesettings and suspicious_login app as they’re integrated with nextcloud.
Note down:
- app version
- nextcloud version
- file integrity check report
- how the app was installed (through the app store or downloaded manually to the apps folder)
Check if there are other users reporting the same, and finally report it to the app developers.
EDIT: I got the same message for bruteforcesettings (and removed the files)