# Home, Inbox and incidents > Read what Cloak Watch found on your Mac, understand each incident in plain words, fix it with Fix it or Fix all, mark false alarms and export an incident. Source: https://docs.subcloak.com/cloak-watch/inbox/ Everything Cloak Watch finds becomes an incident: one card per root cause, however many files and lockfiles it touches. Home tells you whether anything needs you, the Inbox lists every incident by how urgent it is, and each incident page says what happened, what it means for this Mac and how to fix it. ## Home Home is a single status screen for the whole Mac. Its headline, its one round button and its color follow what Watch found. *[Screenshot: Home with a deep red hero: 2 things need fixing now, naming a malicious version of quickcache-utils-demo and a malicious MCP server in Claude Desktop, a round Fix all button, links to Review details and 3 other things to look at, and five chips along the bottom. When something needs fixing now, Home turns red and its button becomes Fix all.]* | State | Headline | Button | |---|---|---| | Before the first scan | **Take stock of this Mac** | **Scan** | | Scanning | **Scanning this Mac**, with what it's reading | A progress ring with the percentage | | Nothing found | **Your Mac is clear**, with how many packages in how many projects Watch checked, and when | **Scan** | | Only things worth a look | **Nothing harmful found**, with **Look at it** or **Look at them** | **Scan** | | Something to fix now | **1 thing needs fixing now** or **N things need fixing now**, naming them, with **Review details** and any other things to look at | **Fix it** or **Fix all** | Along the bottom, five chips count **Packages**, **Extensions**, **AI tools**, **Startup items** and **Keys**. A dot shows each one's state: filled when clean, a ring when something is worth a look, a cross when something is malicious. Click a chip to open that [Inventory](https://docs.subcloak.com/cloak-watch/inventory/) tab. Under them, **Get more from Watch** offers the optional AI extras, and a line shows the feed (for example **Free feed · checked 4 min ago · signature verified**) and today's AI activity. When a new version is out, it adds **Cloak Watch 1.0.x is available · Download**. ## Alert tiers Every incident has one of three tiers. The Inbox groups them under plain names. | Tier | Inbox group | When | How it reaches you | |---|---|---|---| | Act now | **Fix now** | Something malicious is on this Mac, or a key has leaked. | Notifies you at once, even in most Focus modes. Red glyph, counted on the menu bar icon. | | Review | **Worth a look** | Something unusual that isn't confirmed: a new MCP server, a risky setting. | Waits in the Inbox; at most one reminder a day. Orange glyph. | | FYI | **Good to know** | Tips, and attacks that don't affect you. | Waits in the Inbox; never notifies. Grey glyph. | Change how they reach you in [Settings › Alerts](https://docs.subcloak.com/cloak-watch/settings/#alerts). The [detection catalogue](https://docs.subcloak.com/cloak-watch/detections/) gives each check's tier. ## The Inbox The Inbox lists incidents on the left and the selected one on the right. Its subtitle counts them, for example **2 to fix now · 3 worth a look · 2 good to know**. *[Screenshot: The Inbox: a list grouped under Fix now, Worth a look and Good to know, with A malicious version of quickcache-utils-demo is on this Mac selected and its incident page on the right]* - **Open** shows incidents that still need something. **History** keeps the rest, grouped under **Fixed**, **Not a problem** and **Advisories that didn't affect this Mac**. - **Search** filters the list. - Each row shows the headline, where it is (for example **In shopapp, the npm cache and 2 more places**) and when Watch found it. - With nothing open, the Inbox says **Nothing needs you**, with **See History** when there's history to see. - **I Think I've Been Hit…**, at the top, opens a step-by-step plan for containing an attack and revoking, rotating and checking your keys (from 1.2.0). See [Respond to an incident](https://docs.subcloak.com/cloak-watch/respond/). - [Under review](https://docs.subcloak.com/cloak-watch/under-review/) cards, which are coming with the Live Feed plan, show what changed in a new release and how to dispute the review. ## Read an incident An incident page is written for someone who has never heard of the attack. Internal codes only appear under **Details**. *[Screenshot: An incident page: A malicious version of quickcache-utils-demo is on this Mac, a red Fix It button, a What happened section with the dates the bad versions were available and source links, What this means for you, Show evidence, and three numbered steps under Then, yourself]* | Part | What it shows | |---|---| | Headline | What happened on this Mac, for example **A malicious version of quickcache-utils-demo is on this Mac** or **A malicious MCP server is set up in Claude Desktop**. Under it: where, and when Watch found it. | | **Fix It** | When Watch has steps it can do itself: **Watch does N things, and shows you first. Nothing is deleted. You can undo any of it.** When it has none, **Check Again** instead, with **Nothing here for Watch to change. Do the steps below, then check again.** | | **What happened** | The incident in plain words, from the feed's write-up, when the bad versions were available (**The bad versions were available …**), and **Read more** links to the sources. For checks that don't come from the feed, a short explanation of what the check looks for and why. | | **What this means for you** | Where Watch found it, when it arrived and whether that was while the bad version was available, whether its code ran (it left a hook or a background program behind) or it was only downloaded, and which of your credential files the attack collects. Watch checks those files exist; it never reads them. | | **Show evidence (N places)** | A table of every place, described below. | | **What to do** / **Then, yourself** | Steps only you can do, described below. | | **Details** | **Reference** (the feed's ID), **Also known as** (advisory IDs), **Checks that found it** (detection IDs), **First seen** and **Last checked**. | ### Evidence **Show evidence** opens a table with one row per place. | Column | Meaning | |---|---| | **Kind** | Installed, Lockfile, Cache, File, Launch item, Config and so on | | **What** | What Watch saw there, for example `quickcache-utils-demo@6.0.0 installed`. Secrets show only masked. | | **Where** | The path. Hover to see it in full. | | **Arrived** | When the file was last written, from its modification and change times. Hover for the exact time. | | **While out** | **Yes** (red) when it arrived while the bad version was available. **Before** or **After** (green) when it arrived before the bad version was published or after it was taken down. A dash when the arrival time isn't known. | *[Screenshot: The evidence table with five rows: installed package, a setup.mjs file matching known malware, the npm cache, a launch item and a SessionStart hook config, with Arrived 20 h ago and While out Yes for three of them]* ### Steps you do yourself Some steps only you can do, such as replacing a token or reinstalling from a clean lockfile. Watch never runs package managers for you. Each step has: - a short instruction and why; - an **Open …** button when there's a page to go to, such as **Open github.com** for replacing GitHub tokens; - an **I've done this** checkbox. The ticks are only for your own tracking: Watch doesn't check them. Steps that replace tokens are locked until Watch has done its part: **Do this after Fix it, so nothing reacts to the change.** Some worms watch for a revoked token and react, so the background program has to go first. ## Fix it and Fix all **Fix It** on an incident, **Fix all** on Home, and **Fix It…** / **Fix All…** in the menu bar open the same sheet. It shows the whole plan before anything changes. 1. Read the plan. **Watch will** lists the numbered steps in the order Watch runs them. **Afterwards, yourself** lists your own steps. Nothing has changed yet. *[Screenshot: The Fix it sheet's preview: four numbered steps under Watch will, from stopping the background program com.user.gh-token-monitor to moving the npm cache to Quarantine, three steps under Afterwards, yourself, and Cancel and Fix It buttons]* 2. Click **Fix It** (or **Cancel**). Watch runs the steps one at a time, ticking each off. You can keep working; it takes a few seconds. 3. Watch checks the affected places again (**Checking that it's gone…**), then shows the result: - **Fixed. Watch moved N items to Quarantine.** when the incident is gone. - **Watch moved N items to Quarantine. A few things are left for you.** when it's still there, usually because of a step only you can do. **Now, yourself** lists those steps with their links. Do them, then click **Check Again**. Each step Watch did has **Show in Finder** and **Undo**. Click **Done** to close the sheet. *[Screenshot: The Fix it sheet after the run: four steps ticked with Show in Finder and Undo links, and three steps under Now, yourself with Open github.com and Open npmjs.com buttons]* If Subcloak has paused automatic fixes from the signed feed (because one has a problem), the sheet says **Automatic fixes are paused. Here's what needs doing, in this order.** and lists every step for you to do yourself, under **Steps, in order**. If a step fails, Watch stops there (**Watch stopped at step N**) and leaves the rest waiting, because the order matters. Fix the problem it describes, for example a file that belongs to another user, then click **Retry**, or **Close** and come back later. **Fix all** merges the steps of every incident that needs fixing now into one plan, removes duplicates (two incidents can share the same launch agent), and puts them in a safe order. ### What Watch can do itself | Step | What happens | |---|---| | Stop a background program | Stops the launch agent or daemon (`launchctl bootout`) and moves its plist to Quarantine. It stops running now and won't start at login. | | Move a file or folder | Moves it to Quarantine, for example a malicious package folder in `node_modules` or a dropped payload. | | Remove a hook, task, profile line or MCP server | Removes one hook from a Claude Code settings file, one task from `.vscode/tasks.json`, one line from a shell profile, or one MCP server from an AI app's settings. Everything else in the file stays; the original file is kept in Quarantine. | | Move a download cache | Moves the npm, npx, Yarn, pip, uv or Bun cache to Quarantine, so the bad version can't come back from it. The package manager downloads what it needs again on your next install. Watch leaves pnpm's store alone, because projects link into it. | Everything else is a step you do: replacing tokens, reinstalling a package from a clean lockfile, updating a package, recreating Python environments, uninstalling an extension, blocking a domain. ### The order Watch uses 1. Remove persistence first: background programs, hooks and tasks. Some worms watch for revoked tokens and react, one by wiping the home folder. 2. Then files and hooks. 3. Then packages and caches. 4. Then replace secrets. 5. Then block domains. Within each phase, the incident pack's own order wins. ## Mark an incident as not a problem If an incident is something you added on purpose, or a false alarm, tell Watch so it stops showing it. 1. On the incident page, click the **…** button at the top right. 2. Choose **This Isn't a Problem…**. 3. Pick why: **I added this myself**, **It's my company's setup**, **It's a false alarm** or **I don't use this any more**. Watch won't show it again, even after later scans. It moves to **History › Not a problem**, where **Reopen** brings it back. Fixed incidents that come back reopen and notify you again. ## Export an incident The **…** menu on an incident page also has: | Command | What you get | |---|---| | **Export as Markdown…** | A `.md` file with the headline, verdict, what happened with sources, what it means for you, the evidence table, what Watch does on Fix it, your steps with their ticks, and details. | | **Export as PDF…** | The same, as a PDF. | | **Copy Summary** | A short summary on the clipboard. | Exports never include secret values; evidence holds only masked previews. They do include file paths from your Mac, so check before you share one. ## Advisories that didn't affect this Mac When the feed reports an attack and nothing on your Mac matches, Watch records a verdict in **History › Advisories that didn't affect this Mac**: **This Mac isn't affected**, with **Why not**, for example that none of the malicious versions is in your lockfiles, `node_modules`, global installs or caches, and none of the attack's files or background programs is present. *[Screenshot: History in the Inbox: Fixed, Not a problem and Advisories that didn't affect this Mac, with the Paperkite wave advisory selected and its Why not explanation]* ## Related - [Quarantine and restore](https://docs.subcloak.com/cloak-watch/quarantine/): Where moved files go and how to put them back. - [Detection catalogue](https://docs.subcloak.com/cloak-watch/detections/): Every check and its tier. - [Feed](https://docs.subcloak.com/cloak-watch/feed/): Where incidents come from.