# Network alerts

> With its network extension on, Cloak Watch flags install scripts and tools that reach cloud metadata, request catchers or incident addresses, without reading traffic.

Source: https://docs.subcloak.com/cloak-watch/network-alerts/

Added in Cloak Watch 1.2.0.

Network alerts flag the connections that 2025 and 2026 attacks on developers made: an install script asking for cloud credentials, an editor extension sending data to a request catcher, a program reaching an address an incident names. They need Cloak Watch's optional [network extension](https://docs.subcloak.com/cloak-watch/ai-activity/network-extension/), and they're free. Watch looks at which program opened a connection and where it went, never at what was sent.

*[Screenshot: An Act now card: node · postinstall.js asked for cloud credentials (169.254.169.254), with Program /opt/homebrew/bin/node (pid 48122), Signed: ad hoc, Started by: npm ← zsh ← Cursor, and Seen by the network extension; nothing about this connection left your Mac. An install script asking for cloud credentials, on a test Mac.]*

## Turn them on

Turn on the network extension: see [Turn it on](https://docs.subcloak.com/cloak-watch/ai-activity/network-extension/#turn-it-on). There's no separate switch: while the extension is on, Watch checks connections for these shapes.

## What Watch flags

| Alert | Card title | Tier | When |
|---|---|---|---|
| Cloud credentials | "… asked for cloud credentials (…)" | **Act now** when an install script started it; Review otherwise, including editors | Any program connects to a cloud metadata address (`169.254.169.254`, `169.254.170.2`, `metadata.google.internal` and similar). Shai-Hulud used it to steal cloud keys. Azure and AWS editor extensions also check it when they look for cloud credentials, so an editor reaching it is Review, and expected if you use them. |
| Request catchers | "… sent data to a request catcher (…)" | Review | An install script or a program inside an editor reaches webhook.site, pipedream.net, requestbin and similar services. |
| Telegram bots | "… talked to Telegram's bot API" | Review | An install script or a program inside an editor reaches `api.telegram.org`. |
| Solana nodes | "… queried a Solana node" | Review | A program inside an editor (VS Code, Cursor, Windsurf, VSCodium and others) queries a public Solana node. Skipped for editors with a web3 extension installed. |
| IP lookups | "Unsigned … looked up this Mac's public IP" | Review | An unsigned or ad-hoc-signed program asks `api.ipify.org`, `ifconfig.me` or similar for the Mac's public address. |
| GitHub bursts | "… made a burst of GitHub API calls" | Review | An install script makes 8 or more connections to `api.github.com` within 15 seconds. Worms create repositories with stolen tokens. |
| Incident addresses ([NET-1](https://docs.subcloak.com/cloak-watch/detections/#net-1)) | "… connected to …, named in an incident" | **Act now** | Any program connects to a host or IP address named in an incident pack in the feed. |

All but the last are [NET-5](https://docs.subcloak.com/cloak-watch/detections/#net-5). Install scripts are those of npm, pnpm, Yarn, Bun, pip, uv, Poetry, pipx, RubyGems, Bundler, Cargo and Composer.

Each card shows the program and its process ID, how it's signed, and what started it, for example **Started by: npm ← zsh ← Cursor**. Hosts in titles are written with `[.]`, as in `webhook[.]site`, so a copied title isn't a link.

## What to do

- **Act now:** treat the program's keys as stolen. The card lists what to replace, starting with GitHub, npm and cloud keys. Use [I think I've been hit](https://docs.subcloak.com/cloak-watch/respond/) for the full order.
- **Review:** check whether you expected it. A tool you wrote that posts to webhook.site, or a wallet extension you use in your editor, is fine: choose **This Isn't a Problem…** from the card's **…** menu and it won't come back. See [Mark an incident as not a problem](https://docs.subcloak.com/cloak-watch/inbox/#mark-an-incident-as-not-a-problem).

## Privacy and limits

- Watch keeps the program, its parent programs, its signature, the destination, the port and when, in a file only you can read. Records older than 30 days are dropped.
- Nothing about these connections is sent to Subcloak. If you added a [Slack, Discord or webhook destination](https://docs.subcloak.com/cloak-watch/settings/#slack-discord-and-webhooks), Act now cards are posted there, as all Act now cards are.
- The extension looks at outgoing connections on ports 80, 443 and 8443, and on any port to cloud metadata addresses and incident IP addresses. Connections that don't match are passed on untouched and not recorded.
- A destination reached by IP address is matched by address only.

> **Note:**
> The network extension never decrypts anything and installs no certificate. For AI providers it relays the connection to count bytes; every other connection goes straight through. See [Network extension](https://docs.subcloak.com/cloak-watch/ai-activity/network-extension/).

## Related

  - [Network extension](https://docs.subcloak.com/cloak-watch/ai-activity/network-extension/): Turn it on, turn it off, and how it fails open.
  - [Detection catalogue](https://docs.subcloak.com/cloak-watch/detections/#network-net): NET-1 and NET-5.
  - [Respond to an incident](https://docs.subcloak.com/cloak-watch/respond/): What to do after an Act now alert.