https://github.com/x13a/pschk
Check for suspicious processes on macOS
https://github.com/x13a/pschk
macos osx security swift
Last synced: 12 months ago
JSON representation
Check for suspicious processes on macOS
- Host: GitHub
- URL: https://github.com/x13a/pschk
- Owner: x13a
- License: gpl-3.0
- Created: 2021-11-27T13:51:59.000Z (over 4 years ago)
- Default Branch: main
- Last Pushed: 2024-07-20T15:58:18.000Z (almost 2 years ago)
- Last Synced: 2025-04-28T17:44:24.322Z (about 1 year ago)
- Topics: macos, osx, security, swift
- Language: Swift
- Homepage:
- Size: 27.3 KB
- Stars: 5
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# pschk
Check for suspicious processes on macOS
The app shows all running processes that are not signed by Apple as a tree.
Plus it shows Apple signed running processes like shells, script languages
and so on that may be used for malicious activity.
## Installation
```sh
$ make
$ [sudo] make install
```
or
```sh
$ brew tap x13a/tap
$ brew install x13a/tap/pschk
```
## Usage
```text
USAGE: pschk [--version] [--args] [--env] [-a]
OPTIONS:
--version Print version and exit
--args Show arguments for all
--env Show environment vars
-a Show all processes, ignore default filter
-h, --help Show help information.
```
## Example
```sh
~
❯ [sudo] pschk
[74437] [user] /Applications/Firefox.app/Contents/MacOS/firefox
[78984] [user] /Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container
[74448] [user] /Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container
[74552] [user] /Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container
[74449] [user] /Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container
[87122] [user] /Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container
[74015] [user] /Applications/Fork.app/Contents/MacOS/Fork
...
```
## License
[](https://www.gnu.org/licenses/gpl-3.0.en.html)