Notes on what we build and what we find along the way. Mostly macOS internals, storage and security — written up the way we would want to read them.
Latest
A launch agent found on a working Mac read its command-and-control address out of a smart contract on Polygon, then piped the reply straight into osascript. Storing the address on-chain makes it impossible to take down by seizing a domain.
On one working machine: 152.87 GB reclaimable, of which 66.2 GB was safely removable cache. The largest single items were Android emulator snapshots, node_modules and Xcode archives — none of which a general-purpose Mac cleaner looks at.
Because the space is usually held by Time Machine local snapshots, not by the files you deleted. macOS snapshots your disk hourly even with no backup drive attached, and a snapshot pins every block that existed when it was taken.
Reclaim