Tsuba
Takes a look before unfamiliar code runs for the first time.
● Coming soon
- Type
- macOS
- Version
- 0.1.0
- Requires
- macOS 13+
- Price
- Free
Tsuba (鍔) is the hand guard of a Japanese sword. This one sits in your menu bar and steps in at the moments unfamiliar code runs for the first time: it works out what the code is about to do, where it came from and whether it looks like a known attack, then decides to Allow, Warn or Block.
I built it after fake Upwork clients tried to infect my Mac twice. The first time it worked, and neither XProtect nor antivirus noticed. Here is the full story.
Why antivirus misses these attacks
Fake interview projects, fake meeting apps, poisoned npm packages and malicious editor extensions come in new packaging every time. They run through ordinary tools like node, curl and bash, so there is nothing for a traditional scanner to flag. Tsuba watches the entry points instead.
What it checks
| Entry point | Examples | What Tsuba looks at |
|---|---|---|
| Terminal commands | curl … | bash, npm install, npx, npm start, git clone |
Downloads the remote script without running it; checks npm packages against malicious package lists, their age and install scripts; scans the project for hidden code, hard-coded servers and reads of wallets or password stores |
| Pasting into the terminal | A page tells you to "copy this command into your terminal" | Warns the moment you paste; obfuscated commands piped into a shell are flagged as high risk |
| Downloads folder | New .dmg, .pkg, .vsix files |
Signature, notarization, download source and install scripts |
| Editor extensions | VS Code, Cursor, Windsurf, VSCodium | The official malicious extension list, startup activation, code hidden in invisible characters; high-risk extensions go to quarantine |
| AI coding tools | MCP servers, skills and hooks for Claude Code, Cursor, Codex | Known malicious packages, launches from hidden folders, instructions hidden from the user |
| Health Check | Menu bar → Health Check | Traces left by known attacks and suspicious login items |
Projects you're unsure about can be trial-run in a sandbox first: a fake home folder with decoys, network requests recorded but never sent, and a 60-second limit.
How it decides
Offline rules always run first, backed by public threat intel that updates daily, including about 230,000 confirmed malicious npm and PyPI packages from OpenSSF. An AI model can then judge the evidence in context. Claude works best, other providers and local models are supported, and you can turn AI off entirely.
Only the evidence a check needs is sent to the model. Code comments are stripped first, and secrets are never uploaded. Configuration and history stay in ~/.tsuba on your Mac.
Availability
Tsuba is free and will be open source. It is not released yet: the download will appear on this page when the first version ships.