# Feed

> How Cloak Watch learns about new attacks: Live, Headlines and briefs, Check my Mac, how the feed is verified, what free and paid change, and what it reveals.

Source: https://docs.subcloak.com/cloak-watch/feed/

The feed is how Cloak Watch learns about new attacks. Watch downloads it from Subcloak, checks its signatures, and matches it against your Mac locally. The **Feed** section shows the same data for reading: **Live** lists every newly reported malicious package, and **Headlines** explains the few big incidents each week. Both have **Check my Mac**.

## Live

Live lists malicious packages and extensions as public sources report them: OSV's malicious-package records, GitHub's malware advisories, VS Code Marketplace removals and the MCP Registry, and from 1.2, registry takedowns and malicious-code advisories in PyPI's, RustSec's and Go's own databases. Subcloak's feed checks those sources every 10 minutes, so new entries usually reach every Mac, free or paid, within the hour. Live keeps the last 30 days.

*[Screenshot: The Live tab: ecosystem chips, an Only on this Mac checkbox, a red banner saying 2 packages in Live are installed on this Mac, a table of reports with Found, Ecosystem, Package, Versions, On this Mac and What it is, and a selected entry with its Check my Mac answer: checked 6 PyPI items, the package isn't here. The Live tab. This screenshot is from 1.0; from 1.1, Check my Mac says Not affected where it said Not on this Mac.]*

| Column | Meaning |
|---|---|
| (dot) | New since you last looked at Live |
| **Found** | When Subcloak's feed found it. Hover for when the source published it. |
| **Ecosystem** | npm, PyPI, crates.io, Go, RubyGems, VS Code, Open VSX, MCP and others |
| **Package** | The name, with "looks like" and the real name when it imitates a popular package |
| **Versions** | The bad versions, or **All versions** |
| **On this Mac** | **Installed** (red) when your Mac has a listed version, **Other version** when it has the package at a different version |
| **Source** | Who reported it |
| **What it is** | The source's summary, with tags such as **Withdrawn**, **Headline** or **New versions** |

- Filter with the ecosystem chips, **Only on this Mac**, or the search field (**Search packages, IDs, summaries**).
- When something in Live is installed here, a red banner says so, with **Show Them**.
- A registry takedown shows **Registry takedown** as its kind, and its details say "The registry took this down." See [Registry takedowns](#registry-takedowns).
- Select an entry for its details: what it means in plain words, **Check my Mac**, every version, versions added later, look-alike name, identifiers, when it was published and how long the feed took to see it, and source links. A withdrawn entry says so; Watch no longer matches it.

### Registry takedowns

(added in Cloak Watch 1.2.0)

When a registry takes a malicious release down, Watch treats that as confirmation and alerts every Mac, free, without waiting for the public databases, which can take hours to list a hijack of a popular package. What counts:

- **PyPI quarantine.** PyPI quarantines a project when it's reported as malware. For a project with no legitimate history, every version is flagged. For an established project, only the versions PyPI removed around the quarantine, or that a malware report names.
- **npm security placeholders.** npm replaces malware with a `0.0.1-security` placeholder. The versions it replaced are flagged. Subcloak's feed follows npm's placeholders and removals for the most-downloaded packages and the ones it watches closely.
- **A removal backed by a malware report.** A release removed from PyPI, npm or Open VSX counts only when a malware report named that version first; for widely used packages, a second source or a published database record is needed too. Maintainers remove and yank releases for ordinary reasons, so a removal on its own never counts, and a PyPI yank never does.

If PyPI lifts a quarantine, Watch withdraws the alert. If the release is on your Mac, you get an Act now card, and its notification says what the registry did, for example "PyPI has quarantined …" or "npm replaced … with a security placeholder".

### Community lists

(added in Cloak Watch 1.2.0)

Watch also matches your extensions and skills against community lists of malicious ones, named with their license on each card: Datadog's datasets of malicious editor extensions and agent skills (Apache-2.0), and two lists of malicious Chrome extensions, the Privacy Commons Institute's chrome-mal-ids and toborrm9's malicious_extension_sentry (both CC BY 4.0). Entries a list's own analysis disputes are left out, and reviewed false positives are kept on an exclusion list. See [Extensions](https://docs.subcloak.com/cloak-watch/extensions/#feed-and-list-matches).

### Mac stealer checks

(added in Cloak Watch 1.2.0)

The feed carries checks for what 16 macOS stealers and developer backdoors from 2025 and 2026 leave behind, such as Atomic Stealer (AMOS) and Odyssey, each from an analyst's published write-up. Watch looks for the launch items, hidden files and folders they name and, with the [network extension](https://docs.subcloak.com/cloak-watch/network-alerts/), the addresses they contact. A match is an Act now card with steps: stop the launch item, move the files to Quarantine (you can put them back), then change passwords and keys from a clean device.

## Headlines

Headlines are write-ups of the few big incidents each week: a compromised build server, a hijacked popular package, a certificate authority breach. Each covers what happened, a timeline, who's affected, indicators of compromise, how to check, what to do, and the sources.

*[Screenshot: The Headlines tab: today's date, ecosystem chips, a top story card about a package registry's build servers, marked Critical and Developing, and a Today section below]*

Subcloak's newsroom writes each headline from public reports, in its own words, and publishes it automatically, without a person reading it first, only when it passes every automated check:

- at least two independent sources, including a primary one;
- every claim matched to a verified fact from those sources;
- every indicator of compromise taken word for word from a primary source;
- every affected package confirmed on its registry;
- severity set by a fixed rule, not by a writer;
- at most three new headlines a day.

A headline that passed these checks says **Published automatically after checks**; hover over it for the list. The same headlines are published on the web at [headlines.subcloak.com](https://headlines.subcloak.com), and an incident's **Learn more** opens its headline there when one covers it.

In the app, a top story leads, followed by **Affecting this Mac**, **Today**, **This week** and **Earlier**. Each card shows the ecosystem and kind, severity (**Critical**, **High**, **Medium** or **Advisory**), status when it isn't confirmed (**Developing** or **Withdrawn**), and a red **On this Mac** pill when it affects you. Use the arrow keys and <kbd>Return</kbd> to move between cards and open one; <kbd>Esc</kbd> goes back.

A headline's page has these sections:

| Section | What it shows |
|---|---|
| **Check my Mac** | Whether this Mac has what the incident names (below) |
| **What happened** | The incident in plain words |
| **Background** | Context: what the project or company is, and why it matters (when the headline has it) |
| **How it works** | The attack, step by step, in plain words (when the headline has it) |
| **Timeline** | Dated events, each linked to its source |
| **Impact** | Scale and who is at risk (when the headline has it) |
| **Who's affected** | Who needs to act |
| **Indicators of compromise** | Domains, IP addresses, URLs, hashes, file paths and other indicators, shown defanged (`example[.]com`, `hxxps://`) so none is a live link. **Copy** copies the real value; **Copy All** copies them all as tab-separated text; **Export** saves **CSV…** or **JSON…**. |
| **How to check** | Steps, and one row per affected package with what Watch found here |
| **What to do** | Numbered steps |
| **Sources** | Every source, with its date and a link |
| **Changes** | What changed since it was first published |

The facts beside a headline include **Review**: **Published automatically after checks**, or who reviewed it. Severity follows a fixed rule: **Critical** for credential-stealing or remote-code-execution code in a widely used package, a certificate authority compromise, or a compromise of a registry's build or signing systems; **High** for the same code in a package few people use, malicious code in a widely used package, a remote-code-execution vulnerability, or a breach that exposed customers' keys or tokens; **Medium** for everything else.

## Check my Mac

Every Live entry and headline has a **Check my Mac** box. It answers from the inventory of your last scan, on this Mac, without any network request.

For a Live entry, Watch compares the package's name and versions with what's installed:

| Answer | When |
|---|---|
| **Affected: yes** | An incident is open for it, with **Open Incident**. |
| **Installed on this Mac** | A listed version is installed, but no incident pack covers it yet. Treat the Mac as exposed and follow the sources. |
| **Not affected** | Watch checked, for example "Checked 6 PyPI items on this Mac: no reqeusts-example.", or the package is installed at another version. When only a lockfile pins the bad version, so its code never ran, **Open Incident** opens the card that reminds you to remove the pin. |
| **Not checked** | There hasn't been a scan yet (with **Scan Now**), or Watch doesn't list that ecosystem. |

For a headline, Watch checks everything the incident is about: the packages it names, the versions of macOS and your apps and tools, the certificate authorities your tools trust, the services this Mac is signed in to, the workflows in your local repositories, and files the incident leaves behind. It answers **This Mac is affected**, **Relevant to you**, **Not affected** or **Not checked**, lists the places behind the answer with a fix for each, and says what it checked. When an incident is about a service you use, Watch can't see your account, so it says **Relevant to you** and lists what to rotate, in order.

See [Check my Mac](https://docs.subcloak.com/cloak-watch/check-my-mac/) for the four answers, what each check reads, and its limits.

## Briefs

A brief is a short headline written from a single primary source (or two press reports) while an incident is still developing. Subcloak's newsroom publishes it after the automated checks for a brief: every sentence matched to a fact from its source, and indicators taken word for word from it. It shows **Single source · developing** instead of a status, as a compact card after the section's full headlines. A brief's page has fewer sections, lists its packages under **Packages named** without checking them, and its **Check my Mac** says **Not checked** until more sources confirm it. It becomes a full headline when they do.

## Incident packs from headlines

A headline can come with a Subcloak incident pack: the exact files, versions and fixes Watch uses to open incidents. The headline's facts name it under **Incident pack** and say **Watch checks this Mac with it** once this Mac has it. On the free plan, a pack reaches the Mac 24 hours after publishing; until then the facts say when (**Reaches this Mac …**), and **Check my Mac** adds a line saying when it's available to everyone. Some packs are broadcast, for example for a fast-spreading worm, and reach every Mac at once; **Feed Details** marks them **broadcast**.

## How often Watch checks

- Every 60 seconds while the Feed tab is on screen, and every 15 minutes otherwise (every 5 minutes with the live feed), while Watch is running. Subcloak sets these intervals in the signed configuration, and Watch backs off while it's offline.
- Each check downloads only the small signed timestamp file. When it changes, Watch downloads and verifies what's new.
- Click the ↻ button in the Feed header to check now.

The header says when Watch last checked and the newest report from each source, for example **Checked 4 min ago · Newest report 10:28 AM (OSV) · 10:28 AM (GitHub)**. Sources publish in batches every few hours, so Live fills in bursts.

When Watch can't reach the feed, it keeps showing the last copy it verified, with **Offline. Showing the copy verified … ago.** and **Try Again**. Matching keeps working against that copy. When the feed's detections change, Watch matches the inventory it already has against them at once, without reading the disk again. A new Live entry or headline alone doesn't change what's matched.

## Free and the live feed

Every plan runs every check and every fix; [detections are never paywalled](https://docs.subcloak.com/cloak-watch/plans/). The paid live feed, which is coming, only makes warnings and Subcloak's incident packs arrive sooner, including [Under review](https://docs.subcloak.com/cloak-watch/under-review/) cards for suspicious new releases once Subcloak's release scanner sends them.

| What | Free | Live feed |
|---|---|---|
| Live (public malicious-package reports) | Usually within the hour | Usually within the hour |
| Subcloak incident packs (host files, remediation steps, live windows) | After 24 hours | Within minutes |
| Headlines | As soon as they're published | As soon as they're published |
| Background feed checks | Every 15 minutes | Every 5 minutes |

**Feed Details…**, at the bottom of Headlines, shows the plan (with **About the Live Feed…** until it's on sale, then **Try the Live Feed…**), **Live: public malicious packages** and **Subcloak incident packs** for your plan, when Watch last checked and last downloaded a verified copy, when it checks next, the signature state (**Verified (Ed25519, pinned root key)**), how many malicious versions and packs the index holds, the latest packs, and the data sources with their licenses: OSV malicious packages (CC BY 4.0), OpenSSF Malicious Packages (Apache 2.0), GitHub Advisory Database (CC BY 4.0), VS Code RemovedPackages, and Subcloak incident packs.

## Signed configuration

The feed also carries a small signed configuration file. Watch trusts it exactly like the rest of the feed, and uses it for these things:

- **The live feed's terms.** Whether it's on sale, its price and how many Macs a key covers. Plan wording in the app comes from here.
- **How often Macs check.** The background check intervals for the free and paid plans.
- **A minimum version.** If your version can't read the feed any more, a bar asks you to **Update Cloak Watch**.
- **Turning a feature off.** If the AI gateway, the network extension or automatic fixes has a problem, Subcloak can turn it off until it's fixed, without an update. Watch says so in a bar and in [Settings › About](https://docs.subcloak.com/cloak-watch/settings/#about). Detections and the Inbox are never turned off.

A configuration file that doesn't verify, or that's changed on disk, is never used: Watch keeps the last good one, or its built-in defaults.

## How the feed is signed and verified

The feed is a set of static, signed files at `https://feed.subcloak.com/v1/`. Watch trusts it only after checking it the way The Update Framework (TUF) recommends, so a compromised server or download can't slip in a forged entry, an old copy, or a mix of the two.

1. Watch has Subcloak's root key list built in (the pinned root, version 1, valid until 22 October 2027). The root says which keys may sign the rest. If Subcloak rotates keys, Watch follows the chain of new roots, each signed by both the old and the new root keys.

2. It downloads `timestamp.json`, checks its Ed25519 signature, that its version and sequence number never go backwards, that it hasn't expired, and that it isn't dated in the future (more than 5 minutes means the Mac's clock is wrong).

3. The timestamp pins the snapshot file by hash, and the snapshot pins the targets list by hash. Watch checks each hash, version and expiry.

4. The targets list names every other file (incident packs, the malicious-version index, Live, Headlines, the list of exploited flaws, the service catalogue and the configuration) with its length and SHA-256. Watch downloads each one, refuses anything longer, and checks its hash. It then checks every incident pack against its own safety rules.

If any check fails, Watch uses nothing from that download and keeps the last verified copy. Each signed file is wrapped in a DSSE envelope, signed over its exact bytes.

To check the feed yourself, use [`watchctl feed verify`](https://docs.subcloak.com/cloak-watch/watchctl/#feed).

> **Why signatures matter even for news:**
> A forged headline could scare people into running a "fix", the same way a forged pack could hide an attack. That's why Watch verifies Live and Headlines with the same keys as the incident packs, and never loads images from a source: cover art is drawn in the app.

## What's downloaded, and what it reveals

| What | Details |
|---|---|
| Files | `root/N.root.json` when keys rotate, `timestamp.json`, the snapshot and targets files, incident packs, the malicious-version index, Live, Headlines, the list of exploited flaws, the service catalogue and the signed configuration |
| Stored | `~/Library/Application Support/Cloak Watch/Feed`. Files the feed no longer lists are removed. |
| Requests | Plain HTTPS GETs with `User-Agent: CloakWatch/1.0`, no cookies, no credentials, no query strings and no identifiers |
| What Subcloak learns | That a Mac with your IP address downloaded the feed, and when. The files are the same for everyone, so the download can't tell what you have installed. |

Matching happens on your Mac. Watch never sends your inventory, paths, package names or prompts anywhere. See [what leaves your Mac](https://docs.subcloak.com/cloak-watch/settings/#what-leaves-your-mac).

## Related

  - [Plans and pricing](https://docs.subcloak.com/cloak-watch/plans/): Free and the paid live feed.
  - [Check my Mac](https://docs.subcloak.com/cloak-watch/check-my-mac/): The four answers and what each check reads.
  - [Detection catalogue](https://docs.subcloak.com/cloak-watch/detections/): How feed matches become incidents.
  - [Security model and FAQ](https://docs.subcloak.com/cloak-watch/security-and-faq/): What a compromised key could and couldn't do.