Incidents
Real incidents, seen from a Mac.
Case studies of supply-chain attacks and Mac malware: what each one did, what it looked like on the network, and what Kilobat would have shown or blocked. Each page also says where Kilobat wouldn’t have helped, and how to check your own Mac today.
How to read these pages
- Blocklists catch up after the fact. Threat lists add an attack’s hosts once someone has found them. None of these pages claim Kilobat would have stopped an attack unless its rules would have, on the day.
- A lot of attacks look like normal traffic. Stolen data sent to github.com, or a secret printed in a CI log, never touches a suspicious host. The pages say so.
- Facts come from the people who investigated. Maintainers’ post-mortems, the researchers who found the attack, and advisories such as GitHub’s and CISA’s. Each page lists them with the date they were checked.
Case studies
26–27 August 2025 · npm package compromise
Nx “s1ngularity”
Malicious Nx versions ran installed AI CLIs to find secrets, then published them to a new repository in the victim’s GitHub account.
- Protection: wouldn’t help
- Agent guard: wouldn’t help
- Agent network log: limited
- Protection: wouldn’t help
- Agent guard: wouldn’t help
- Agent network log: limited
- Protection: limited
- Ask about new apps: limited
- App traffic: would show
- Agent guard: wouldn’t help
- Protection: wouldn’t help
- Agent guard: wouldn’t help
- Agent network log: wouldn’t help
- App traffic: limited
- Protection: wouldn’t help
- Agent guard: wouldn’t help
- Agent network log: limited
“Would block” means Kilobat’s own rules would have refused the connection on the day: an agent-guard rule, or a host that was on the threat lists then. “Would show” means the agent network log or Kilobat’s app list would have recorded it for you to see. “Limited” means it depends on how the attack reached your Mac.
Know what every app and agent on your Mac connects to.
Download for Mac ↓
brew install seifip/kilobat/kilobat