Investigation: How EtreCheck Source Code Appeared on My Mac

Investigation: How EtreCheck Source Code Appeared on My Mac

Background

I discovered mysterious files in my Downloads folder on my external SSD running macOS Ventura. I had never downloaded EtreCheck onto this drive, and nobody else uses my computer. When I tried to open the README.md file, macOS showed a security warning that it couldn't verify the developer, warning about potential malware.

Initial Discovery
The files appeared to be:

EtreCheck-master folder
EtreCheck.xcodeproj (Xcode project file)
LICENSE file
README.md file

All files showed Safari downloaded them on August 10, 2025. The security warning was concerning because I had no memory of downloading these files.

Investigation Process

Question 1: Can Claude examine software?
My Question: "Can you download and examine software?"
Answer: No, Claude cannot download or execute software. However, Claude can:

Fetch and read web page contents via URLs
Search the web for information about software
Read and analyze code shared directly in conversation
Review documentation from public repositories
Examine software through publicly available information

Question 2: The Security Warning

I shared a screenshot showing:

The Downloads folder with EtreCheck files
A macOS security dialog warning: "macOS cannot verify the developer of 'README.md'. Are you sure you want to open it?"
The warning stated: "By opening this app, you will be overriding system security which can expose your computer and personal information to malware that may harm your Mac or compromise your privacy."
The dialog noted Safari downloaded the file on August 10, 2025

Initial Assessment: This appeared concerning because:

I didn't remember downloading it
Nobody else uses my computer
The security warning suggested potential risk
The files appeared without my knowledge

Recommended Actions:

Click "Cancel" on the security dialog
Check Safari download history
Check for other suspicious activity
Delete the files if origin unclear
Run security scans

Question 3: Examining the Source Code

I shared the project.pbxproj file contents from Pastebin.

Analysis Results:
The file was a legitimate Xcode project configuration file for EtreCheck, containing:

Build settings and project structure
System diagnostics collectors (hardware, disk, USB, memory, CPU)
Launch agents/daemons collectors
Plugin collectors (Safari, iTunes, Internet plugins)
An AdwareCollector component (EtreCheck includes adware detection)

Key Finding: The code appeared legitimate - it was the genuine EtreCheck source code from July 2015. However, this didn't explain HOW it got on my system without my knowledge.

Question 4: Investigating the Timeline

My Statement: "I've been investigating EtreCheck for many years. I have downloaded it and run it many times on my internal hard drive (which has been wiped clean and now has Linux Mint 22.2 on it!) but I've NOT downloaded EtreCheck onto my external SSD, from where I'm currently running macOS Ventura. I have no idea how it got here."

Critical Detail Identified: The security dialog said Safari downloaded the file on August 10, 2025 - only 3.5 months before this investigation (November 29, 2025). This was AFTER my internal drive was wiped and I was already running macOS from the external SSD.

Possible Explanations Considered:

Time Machine or Migration Assistant backup restoration
Cloud sync services (iCloud Drive, Dropbox, etc.)
Safari/Browser sync across devices
Manual copy forgotten during setup
Malicious activity (less likely)

Question 5: File Timestamp Analysis

I shared a screenshot showing ALL files had identical timestamps: 10 Aug 2025 at 16:37
Critical Finding: When files are extracted from a ZIP archive, macOS sets all files to the same "Date Modified" timestamp - the extraction time. This meant someone extracted "EtreCheck-master.zip" at exactly 16:37 on August 10, 2025.
The folder name "EtreCheck-master" is the default name GitHub uses for downloaded repository ZIP files.

Question 6: Searching for the Source ZIP
Command Run:
bashls -la ~/Downloads/*.zip
Results: No EtreCheck ZIP file found - only other downloads:

AppCleaner_3.6.8.zip (Nov 17)
KnockKnock_3.1.0.zip (Nov 17)
OperaGXSetup.zip (Nov 18)
Facebook data archives (Oct 2)
raidvid.zip (Mar 2016)

Conclusion: The source ZIP was deleted or moved after extraction.

Question 7: Checking Extended Attributes
Command Run:
bashls -la ~/Downloads/ | grep -i etrecheck
Results Found:

drwxr-xr-x@ 8 davidbrooks staff 256 10 Aug 16:39 EtreCheck-master
rw-r--r--@ 1 davidbrooks staff 76295 21 Sep 21:30 etrecheck-lance.pdf

New Discovery: There was also an "etrecheck-lance.pdf" file from September 21, 2025 - suggesting I had been actively researching EtreCheck.

Question 8: THE SMOKING GUN - Extended Attribute Analysis

Command Run:
bashxattr -l ~/Downloads/EtreCheck-master
Results:
com.apple.quarantine: 0083;6898bcce;Safari;6A46097C-7C34-4F04-BF33-ABE6455844E8
This revealed:

Downloaded by: Safari
Timestamp: 6898bcce (hexadecimal)
Download identifier: 6A46097C-7C34-4F04-BF33-ABE6455844E8

Command Run:
bashxattr -l ~/Downloads/etrecheck-lance.pdf
CRITICAL DISCOVERY:
com.apple.metadata:kMDItemWhereFroms: bplist00?_Ehttps://forums.macrumors.com/attachments/etrecheck-lance-pdf.2551417/_`https://forums.macrumors.com/threads/multiple-system-performance-oddities.2466307/?post=34147757
BREAKTHROUGH: The PDF was downloaded from MacRumors forums - specifically from a thread titled "multiple system performance oddities" where someone named Lance posted their EtreCheck report!

Question 9: The Final Piece of the Puzzle
My Revelation: "That's possible. MacRumors has banned me - I think for asking too many questions about EtreCheck!"

MYSTERY SOLVED!

What Actually Happened:

August-September 2025: I was actively researching EtreCheck on MacRumors forums
I was asking so many questions about EtreCheck that I eventually got banned from MacRumors
During this research, I downloaded EtreCheck reports from other users (like Lance's PDF on Sept 21)
On August 10, 2025 at 16:37, I clicked a link (likely from MacRumors or directly to GitHub) and downloaded the EtreCheck source code as "EtreCheck-master.zip"
I extracted the ZIP file to examine the source code
Months later (November 2025), I completely forgot about this download
When macOS warned me about the unverified README.md file, I became concerned it was unauthorized access

The folder name "EtreCheck-master" is the telltale sign - that's exactly what GitHub names downloaded repository archives.

Conclusion
This was NOT a security breach. This was legitimate research I conducted myself and simply forgot about months later.
Evidence:

✅ I was banned from MacRumors for asking too many questions about EtreCheck
✅ I downloaded an EtreCheck report from user "Lance" on Sept 21
✅ The source code was downloaded via Safari from what appears to be GitHub
✅ The folder name matches GitHub's default naming convention
✅ All files have identical timestamps indicating archive extraction
✅ The timeline matches my intense research period

Lessons Learned:

Keep better notes when doing deep research
It's easy to forget downloads from months ago, especially during intense investigation periods
Extended attributes (xattr) are invaluable for investigating mysterious files
The "EtreCheck-master" naming convention is a clear indicator of GitHub downloads

Additional Concerns About EtreCheck Developer
During this investigation, I received an email from the EtreCheck developer (Brent via groups.io) containing this statement:

"Several years ago, I snuck into the Eaton Centre Apple Store to run some EtreCheck reports on their computers. I thought I had a bug in EtreCheck because it seemed to lock up on the 2014 mini. But eventually, the report showed up. That brand new computer was the slowest computer I had ever tested on. I was glad to get that result before they discovered what I was doing and threw me out of the store."

Professional Assessment: This behavior is completely unprofessional and ethically questionable for several reasons:

Unauthorized software installation - Running personal software on store demo units without permission violates store policy and potentially constitutes unauthorized computer access
Deceptive behavior - "Sneaking" into a store and hoping not to get caught is not how professionals operate
Inappropriate testing methodology - Store demo units are:

Heavily used by the public
Running demo software and tracking tools
Connected to store networks with monitoring
NOT representative of normal user experience
Often thermally throttled from constant operation


Better alternatives existed:

Contact Apple directly for test hardware
Ask Apple Store management for permission
Use virtualization or proper test equipment
Recruit beta testers with appropriate hardware
Purchase refurbished units for testing


Reputational risk - Publicly bragging about this behavior reflects poorly on professional judgment

What a professional developer should do:

Request proper testing hardware through legitimate channels
Build a beta testing program with consenting users
Use diagnostic data from users who opt-in
Work with Apple's developer relations team
Be transparent about testing methods

This anecdote, combined with my ban from MacRumors for "asking too many questions about EtreCheck," suggests the developer may be overly defensive about criticism and operates with questionable professional boundaries.

Investigation conducted November 29, 2025
All commands and analysis performed on macOS Ventura running from external SSD