Apps and helpers

What is ShipIt?

ShipIt comes from Squirrel.Mac. Electron apps such as chat and editor apps use it to install updates. The app downloads the update first, inside its own process.

Process: ShipItMade by Squirrel.Mac, bundled by each Electron appApplies to: Electron apps that use Squirrel.Mac, on macOS 14 Sonoma and later. Checked on 1 November 2026 against Electron's documentation.Checked: 1 November 2026

Short answer

Part of Squirrel.Mac, the updater that many Electron apps include. It installs an update that the app has already downloaded.

Safe to block

Safe to block for a while, but the app then can't install its updates. Block or pause the app's download instead.

Path: /Applications/<App>.app/Contents/Frameworks/Squirrel.framework/Resources/ShipIt

What it is

Electron's documentation says that its macOS updater is built on Squirrel.Mac. ShipIt is the part of Squirrel.Mac that installs the update.

Electron says that a downloaded update is applied when the app starts again.

Each app includes its own copy of Squirrel.Mac. So ShipIt appears with different paths, one per app.

Squirrel.Mac's documentation says that an update is put through code signing verification before it is installed. A delta update is applied to a copy of the running app first.

If a delta update fails, Squirrel.Mac downloads the full ZIP instead, in the same check.

Why it uses the network

Installation. ShipIt installs an update that the app already downloaded. The download shows under the app.
Small or no traffic of its own. Its job is to replace the app on disk. Electron's documentation describes the download as the app's job.

How much is normal

ShipIt runs for a short time when an app updates. Its own traffic is small or none.

The download itself is about the size of the app.

If an app updates often, you'll see ShipIt often.

When it uses a lot, and why

The app's download, not ShipIt's. The bytes of an update usually show under the app, or its helper, before ShipIt runs.
A failed delta. Squirrel.Mac says that when a delta update fails, it downloads the full ZIP. That download is larger.

Is it safe to block?

Safe to block

Safe to block for a while, but the app then can't install its updates. Block or pause the app's download instead.

What breaks if you block it

Downloaded updates of the app can't be installed.
The app may try again each time it starts.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

Open the settings of the app. Turn off automatic updates, if the app has that option.
Update the app later, on your usual network.

See how much it uses

Open Activity Monitor from Applications › Utilities. Click Network.
Type ShipIt in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.
In Terminal, watch only this process. Press d to show the change per second, and q to quit.
```
nettop -p 'ShipIt' -P
```

With Kilobat

Kilobat recognises Squirrel's helper as an updater. When the app downloads updates in its own process, Kilobat can only block the whole app.
```
kilobat updaters
```
Ask the same question in Terminal.
```
kilobat explain ShipIt
```

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

What isn’t documented

Apps choose how they use Squirrel.Mac. Whether an app checks daily, at launch or only when you ask is up to that app.

Questions

Why can't Kilobat pause these updates?

The app downloads the update inside its own process. Kilobat can only block the whole app.

Where does ShipIt come from?

It is part of Squirrel.Mac, an open-source Cocoa framework for updating Mac apps, published on GitHub.

Is ShipIt malware?

No. It is part of Squirrel.Mac, inside the app that uses it. Check the path to see which app it belongs to.

Sources

Checked on 1 November 2026.