Protect your Mac

Feed

How Cloak Watch learns about new attacks: Live, Headlines and briefs, Check my Mac, how the feed is verified, what free and paid change, and what it reveals.

The feed is how Cloak Watch learns about new attacks. Watch downloads it from Subcloak, checks its signatures, and matches it against your Mac locally. The Feed section shows the same data for reading: Live lists every newly reported malicious package, and Headlines explains the few big incidents each week. Both have Check my Mac.

Live

Live lists malicious packages and extensions as public sources report them: OSV’s malicious-package records, GitHub’s malware advisories, VS Code Marketplace removals and the MCP Registry, and from 1.2, registry takedowns and malicious-code advisories in PyPI’s, RustSec’s and Go’s own databases. Subcloak’s feed checks those sources every 10 minutes, so new entries usually reach every Mac, free or paid, within the hour. Live keeps the last 30 days.

Column	Meaning
(dot)	New since you last looked at Live
Found	When Subcloak’s feed found it. Hover for when the source published it.
Ecosystem	npm, PyPI, crates.io, Go, RubyGems, VS Code, Open VSX, MCP and others
Package	The name, with “looks like” and the real name when it imitates a popular package
Versions	The bad versions, or All versions
On this Mac	Installed (red) when your Mac has a listed version, Other version when it has the package at a different version
Source	Who reported it
What it is	The source’s summary, with tags such as Withdrawn, Headline or New versions

Filter with the ecosystem chips, Only on this Mac, or the search field (Search packages, IDs, summaries).
When something in Live is installed here, a red banner says so, with Show Them.
A registry takedown shows Registry takedown as its kind, and its details say “The registry took this down.” See Registry takedowns.
Select an entry for its details: what it means in plain words, Check my Mac, every version, versions added later, look-alike name, identifiers, when it was published and how long the feed took to see it, and source links. A withdrawn entry says so; Watch no longer matches it.

Registry takedowns

New in 1.2.0

When a registry takes a malicious release down, Watch treats that as confirmation and alerts every Mac, free, without waiting for the public databases, which can take hours to list a hijack of a popular package. What counts:

PyPI quarantine. PyPI quarantines a project when it’s reported as malware. For a project with no legitimate history, every version is flagged. For an established project, only the versions PyPI removed around the quarantine, or that a malware report names.
npm security placeholders. npm replaces malware with a 0.0.1-security placeholder. The versions it replaced are flagged. Subcloak’s feed follows npm’s placeholders and removals for the most-downloaded packages and the ones it watches closely.
A removal backed by a malware report. A release removed from PyPI, npm or Open VSX counts only when a malware report named that version first; for widely used packages, a second source or a published database record is needed too. Maintainers remove and yank releases for ordinary reasons, so a removal on its own never counts, and a PyPI yank never does.

If PyPI lifts a quarantine, Watch withdraws the alert. If the release is on your Mac, you get an Act now card, and its notification says what the registry did, for example “PyPI has quarantined …” or “npm replaced … with a security placeholder”.

Community lists

New in 1.2.0

Watch also matches your extensions and skills against community lists of malicious ones, named with their license on each card: Datadog’s datasets of malicious editor extensions and agent skills (Apache-2.0), and two lists of malicious Chrome extensions, the Privacy Commons Institute’s chrome-mal-ids and toborrm9’s malicious_extension_sentry (both CC BY 4.0). Entries a list’s own analysis disputes are left out, and reviewed false positives are kept on an exclusion list. See Extensions.

Mac stealer checks

New in 1.2.0

The feed carries checks for what 16 macOS stealers and developer backdoors from 2025 and 2026 leave behind, such as Atomic Stealer (AMOS) and Odyssey, each from an analyst’s published write-up. Watch looks for the launch items, hidden files and folders they name and, with the network extension, the addresses they contact. A match is an Act now card with steps: stop the launch item, move the files to Quarantine (you can put them back), then change passwords and keys from a clean device.

Headlines

Headlines are write-ups of the few big incidents each week: a compromised build server, a hijacked popular package, a certificate authority breach. Each covers what happened, a timeline, who’s affected, indicators of compromise, how to check, what to do, and the sources.

Subcloak’s newsroom writes each headline from public reports, in its own words, and publishes it automatically, without a person reading it first, only when it passes every automated check:

at least two independent sources, including a primary one;
every claim matched to a verified fact from those sources;
every indicator of compromise taken word for word from a primary source;
every affected package confirmed on its registry;
severity set by a fixed rule, not by a writer;
at most three new headlines a day.

A headline that passed these checks says Published automatically after checks; hover over it for the list. The same headlines are published on the web at headlines.subcloak.com, and an incident’s Learn more opens its headline there when one covers it.

In the app, a top story leads, followed by Affecting this Mac, Today, This week and Earlier. Each card shows the ecosystem and kind, severity (Critical, High, Medium or Advisory), status when it isn’t confirmed (Developing or Withdrawn), and a red On this Mac pill when it affects you. Use the arrow keys and Return to move between cards and open one; Esc goes back.

A headline’s page has these sections:

Section	What it shows
Check my Mac	Whether this Mac has what the incident names (below)
What happened	The incident in plain words
Background	Context: what the project or company is, and why it matters (when the headline has it)
How it works	The attack, step by step, in plain words (when the headline has it)
Timeline	Dated events, each linked to its source
Impact	Scale and who is at risk (when the headline has it)
Who’s affected	Who needs to act
Indicators of compromise	Domains, IP addresses, URLs, hashes, file paths and other indicators, shown defanged (`example[.]com`, `hxxps://`) so none is a live link. Copy copies the real value; Copy All copies them all as tab-separated text; Export saves CSV… or JSON….
How to check	Steps, and one row per affected package with what Watch found here
What to do	Numbered steps
Sources	Every source, with its date and a link
Changes	What changed since it was first published

The facts beside a headline include Review: Published automatically after checks, or who reviewed it. Severity follows a fixed rule: Critical for credential-stealing or remote-code-execution code in a widely used package, a certificate authority compromise, or a compromise of a registry’s build or signing systems; High for the same code in a package few people use, malicious code in a widely used package, a remote-code-execution vulnerability, or a breach that exposed customers’ keys or tokens; Medium for everything else.

Check my Mac

Every Live entry and headline has a Check my Mac box. It answers from the inventory of your last scan, on this Mac, without any network request.

For a Live entry, Watch compares the package’s name and versions with what’s installed:

Answer	When
Affected: yes	An incident is open for it, with Open Incident.
Installed on this Mac	A listed version is installed, but no incident pack covers it yet. Treat the Mac as exposed and follow the sources.
Not affected	Watch checked, for example “Checked 6 PyPI items on this Mac: no reqeusts-example.”, or the package is installed at another version. When only a lockfile pins the bad version, so its code never ran, Open Incident opens the card that reminds you to remove the pin.
Not checked	There hasn’t been a scan yet (with Scan Now), or Watch doesn’t list that ecosystem.

For a headline, Watch checks everything the incident is about: the packages it names, the versions of macOS and your apps and tools, the certificate authorities your tools trust, the services this Mac is signed in to, the workflows in your local repositories, and files the incident leaves behind. It answers This Mac is affected, Relevant to you, Not affected or Not checked, lists the places behind the answer with a fix for each, and says what it checked. When an incident is about a service you use, Watch can’t see your account, so it says Relevant to you and lists what to rotate, in order.

See Check my Mac for the four answers, what each check reads, and its limits.

Briefs

A brief is a short headline written from a single primary source (or two press reports) while an incident is still developing. Subcloak’s newsroom publishes it after the automated checks for a brief: every sentence matched to a fact from its source, and indicators taken word for word from it. It shows Single source · developing instead of a status, as a compact card after the section’s full headlines. A brief’s page has fewer sections, lists its packages under Packages named without checking them, and its Check my Mac says Not checked until more sources confirm it. It becomes a full headline when they do.

Incident packs from headlines

A headline can come with a Subcloak incident pack: the exact files, versions and fixes Watch uses to open incidents. The headline’s facts name it under Incident pack and say Watch checks this Mac with it once this Mac has it. On the free plan, a pack reaches the Mac 24 hours after publishing; until then the facts say when (Reaches this Mac …), and Check my Mac adds a line saying when it’s available to everyone. Some packs are broadcast, for example for a fast-spreading worm, and reach every Mac at once; Feed Details marks them broadcast.

How often Watch checks

Every 60 seconds while the Feed tab is on screen, and every 15 minutes otherwise (every 5 minutes with the live feed), while Watch is running. Subcloak sets these intervals in the signed configuration, and Watch backs off while it’s offline.
Each check downloads only the small signed timestamp file. When it changes, Watch downloads and verifies what’s new.
Click the ↻ button in the Feed header to check now.

The header says when Watch last checked and the newest report from each source, for example Checked 4 min ago · Newest report 10:28 AM (OSV) · 10:28 AM (GitHub). Sources publish in batches every few hours, so Live fills in bursts.

When Watch can’t reach the feed, it keeps showing the last copy it verified, with Offline. Showing the copy verified … ago. and Try Again. Matching keeps working against that copy. When the feed’s detections change, Watch matches the inventory it already has against them at once, without reading the disk again. A new Live entry or headline alone doesn’t change what’s matched.

Free and the live feed

Every plan runs every check and every fix; detections are never paywalled. The paid live feed, which is coming, only makes warnings and Subcloak’s incident packs arrive sooner, including Under review cards for suspicious new releases once Subcloak’s release scanner sends them.

What	Free	Live feed
Live (public malicious-package reports)	Usually within the hour	Usually within the hour
Subcloak incident packs (host files, remediation steps, live windows)	After 24 hours	Within minutes
Headlines	As soon as they’re published	As soon as they’re published
Background feed checks	Every 15 minutes	Every 5 minutes

Feed Details…, at the bottom of Headlines, shows the plan (with About the Live Feed… until it’s on sale, then Try the Live Feed…), Live: public malicious packages and Subcloak incident packs for your plan, when Watch last checked and last downloaded a verified copy, when it checks next, the signature state (Verified (Ed25519, pinned root key)), how many malicious versions and packs the index holds, the latest packs, and the data sources with their licenses: OSV malicious packages (CC BY 4.0), OpenSSF Malicious Packages (Apache 2.0), GitHub Advisory Database (CC BY 4.0), VS Code RemovedPackages, and Subcloak incident packs.

Signed configuration

The feed also carries a small signed configuration file. Watch trusts it exactly like the rest of the feed, and uses it for these things:

The live feed’s terms. Whether it’s on sale, its price and how many Macs a key covers. Plan wording in the app comes from here.
How often Macs check. The background check intervals for the free and paid plans.
A minimum version. If your version can’t read the feed any more, a bar asks you to Update Cloak Watch.
Turning a feature off. If the AI gateway, the network extension or automatic fixes has a problem, Subcloak can turn it off until it’s fixed, without an update. Watch says so in a bar and in Settings › About. Detections and the Inbox are never turned off.

A configuration file that doesn’t verify, or that’s changed on disk, is never used: Watch keeps the last good one, or its built-in defaults.

How the feed is signed and verified

The feed is a set of static, signed files at https://feed.subcloak.com/v1/. Watch trusts it only after checking it the way The Update Framework (TUF) recommends, so a compromised server or download can’t slip in a forged entry, an old copy, or a mix of the two.

Watch has Subcloak’s root key list built in (the pinned root, version 1, valid until 22 October 2027). The root says which keys may sign the rest. If Subcloak rotates keys, Watch follows the chain of new roots, each signed by both the old and the new root keys.
It downloads timestamp.json, checks its Ed25519 signature, that its version and sequence number never go backwards, that it hasn’t expired, and that it isn’t dated in the future (more than 5 minutes means the Mac’s clock is wrong).
The timestamp pins the snapshot file by hash, and the snapshot pins the targets list by hash. Watch checks each hash, version and expiry.
The targets list names every other file (incident packs, the malicious-version index, Live, Headlines, the list of exploited flaws, the service catalogue and the configuration) with its length and SHA-256. Watch downloads each one, refuses anything longer, and checks its hash. It then checks every incident pack against its own safety rules.

If any check fails, Watch uses nothing from that download and keeps the last verified copy. Each signed file is wrapped in a DSSE envelope, signed over its exact bytes.

To check the feed yourself, use watchctl feed verify.

What’s downloaded, and what it reveals

What	Details
Files	`root/N.root.json` when keys rotate, `timestamp.json`, the snapshot and targets files, incident packs, the malicious-version index, Live, Headlines, the list of exploited flaws, the service catalogue and the signed configuration
Stored	`~/Library/Application Support/Cloak Watch/Feed`. Files the feed no longer lists are removed.
Requests	Plain HTTPS GETs with `User-Agent: CloakWatch/1.0`, no cookies, no credentials, no query strings and no identifiers
What Subcloak learns	That a Mac with your IP address downloaded the feed, and when. The files are the same for everyone, so the download can’t tell what you have installed.

Matching happens on your Mac. Watch never sends your inventory, paths, package names or prompts anywhere. See what leaves your Mac.

Plans and pricingFree and the paid live feed.

Check my MacThe four answers and what each check reads.

Detection catalogueHow feed matches become incidents.

Security model and FAQWhat a compromised key could and couldn't do.

Feed

Live

Registry takedowns

Community lists

Mac stealer checks

Headlines

Check my Mac

Briefs

Incident packs from headlines

How often Watch checks

Free and the live feed

Signed configuration

How the feed is signed and verified

What’s downloaded, and what it reveals

Related