What Watch checks
Network alerts
New in 1.2.0 Requires Cloak Watch 1.2.0 or later.
With its network extension on, Cloak Watch flags install scripts and tools that reach cloud metadata, request catchers or incident addresses, without reading traffic.
Network alerts flag the connections that 2025 and 2026 attacks on developers made: an install script asking for cloud credentials, an editor extension sending data to a request catcher, a program reaching an address an incident names. They need Cloak Watch’s optional network extension, and they’re free. Watch looks at which program opened a connection and where it went, never at what was sent.
An install script asking for cloud credentials, on a test Mac.
Turn them on
Section titled “Turn them on”Turn on the network extension: see Turn it on. There’s no separate switch: while the extension is on, Watch checks connections for these shapes.
What Watch flags
Section titled “What Watch flags”| Alert | Card title | Tier | When |
|---|---|---|---|
| Cloud credentials | “… asked for cloud credentials (…)” | Act now when an install script started it; Review otherwise, including editors | Any program connects to a cloud metadata address (169.254.169.254, 169.254.170.2, metadata.google.internal and similar). Shai-Hulud used it to steal cloud keys. Azure and AWS editor extensions also check it when they look for cloud credentials, so an editor reaching it is Review, and expected if you use them. |
| Request catchers | “… sent data to a request catcher (…)” | Review | An install script or a program inside an editor reaches webhook.site, pipedream.net, requestbin and similar services. |
| Telegram bots | “… talked to Telegram’s bot API” | Review | An install script or a program inside an editor reaches api.telegram.org. |
| Solana nodes | “… queried a Solana node” | Review | A program inside an editor (VS Code, Cursor, Windsurf, VSCodium and others) queries a public Solana node. Skipped for editors with a web3 extension installed. |
| IP lookups | “Unsigned … looked up this Mac’s public IP” | Review | An unsigned or ad-hoc-signed program asks api.ipify.org, ifconfig.me or similar for the Mac’s public address. |
| GitHub bursts | “… made a burst of GitHub API calls” | Review | An install script makes 8 or more connections to api.github.com within 15 seconds. Worms create repositories with stolen tokens. |
| Incident addresses (NET-1) | “… connected to …, named in an incident” | Act now | Any program connects to a host or IP address named in an incident pack in the feed. |
All but the last are NET-5. Install scripts are those of npm, pnpm, Yarn, Bun, pip, uv, Poetry, pipx, RubyGems, Bundler, Cargo and Composer.
Each card shows the program and its process ID, how it’s signed, and what started it, for example Started by: npm ← zsh ← Cursor. Hosts in titles are written with [.], as in webhook[.]site, so a copied title isn’t a link.
What to do
Section titled “What to do”- Act now: treat the program’s keys as stolen. The card lists what to replace, starting with GitHub, npm and cloud keys. Use I think I’ve been hit for the full order.
- Review: check whether you expected it. A tool you wrote that posts to webhook.site, or a wallet extension you use in your editor, is fine: choose This Isn’t a Problem… from the card’s … menu and it won’t come back. See Mark an incident as not a problem.
Privacy and limits
Section titled “Privacy and limits”- Watch keeps the program, its parent programs, its signature, the destination, the port and when, in a file only you can read. Records older than 30 days are dropped.
- Nothing about these connections is sent to Subcloak. If you added a Slack, Discord or webhook destination, Act now cards are posted there, as all Act now cards are.
- The extension looks at outgoing connections on ports 80, 443 and 8443, and on any port to cloud metadata addresses and incident IP addresses. Connections that don’t match are passed on untouched and not recorded.
- A destination reached by IP address is matched by address only.