Tsuba
Takes a look before unfamiliar code runs for the first time.
- Type
- macOS
- Version
- 0.1.0
- Requires
- macOS 13+
- Price
- Free
Tsuba (鍔) is the hand guard of a Japanese sword. This one sits in your menu bar and steps in at the moments unfamiliar code runs for the first time: it works out what the code is about to do, where it came from and whether it looks like a known attack, then decides to Allow, Warn or Block.
I built it after fake Upwork clients tried to infect my Mac twice. The first time it worked, and neither XProtect nor antivirus noticed. Here is the full story.
Why antivirus misses these attacks
Fake interview projects, fake meeting apps, poisoned npm packages and malicious editor extensions come in new packaging every time. They run through ordinary tools like node, curl and bash, so there is nothing for a traditional scanner to flag. Tsuba watches the entry points instead.
What it checks
| Entry point | Examples | What Tsuba looks at |
|---|---|---|
| Terminal commands | curl … | bash, npm install, npx, npm start, git clone |
Downloads the remote script without running it; checks npm packages against malicious package lists, their age and install scripts; scans the project for hidden code, hard-coded servers and reads of wallets or password stores |
| Pasting into the terminal | A page tells you to "copy this command into your terminal" | Warns the moment you paste; obfuscated commands piped into a shell are flagged as high risk |
| Downloads folder | New .dmg, .pkg, .vsix files |
Signature, notarization, download source and install scripts |
| Editor extensions | VS Code, Cursor, Windsurf, VSCodium | The official malicious extension list, startup activation, code hidden in invisible characters; high-risk extensions go to quarantine |
| AI coding tools | MCP servers, skills and hooks for Claude Code, Cursor, Codex | Known malicious packages, launches from hidden folders, instructions hidden from the user |
| Health Check | Menu bar → Health Check | Traces left by known attacks and suspicious login items |
Projects you're unsure about can be trial-run in a sandbox first: a fake home folder with decoys, network requests recorded but never sent, and a 60-second limit.
How it decides
Offline rules always run first, backed by public threat intel that updates daily, including about 230,000 confirmed malicious npm and PyPI packages from OpenSSF. An AI model can then judge the evidence in context. Claude works best, other providers and local models are supported, and you can turn AI off entirely.
Only the evidence a check needs is sent to the model. Code comments are stripped first, and secrets are never uploaded. Configuration and history stay in ~/.tsuba on your Mac.
Availability
Tsuba 0.1.0 is out, free, and its source is on GitHub. There are two builds: pick Apple silicon for M1 and later Macs, Intel for older ones. Not sure which you have? Apple menu → About This Mac → Chip.
This first build is not signed or notarized by Apple yet, so macOS blocks it the first time you open it. Go to System Settings → Privacy & Security and click Open Anyway. Please don't remove the quarantine flag with xattr instead: Tsuba warns about installers that ask you to, and its own shouldn't be the exception.
To check that your DMG is the one GitHub built from the public source, compare shasum -a 256 Tsuba_*.dmg with SHA256SUMS.txt on the release page.