UPDATE, August 2026. On August 5th, Apple pushed XProtect 5354 with a brand-new file, AppProtectionPolicy.plist, listing the Team IDs and Signing IDs allowed for sensitive third-party apps (encrypted messaging, browsers, crypto wallets), plus a Yara rule targeting MACOS.NEFARIOUSNAPKIN. The version cited below, 5344 from May 12th, is no longer the latest.

While you were sleeping, on the evening of May 11th, 170 software packages, used by half of the web, became malicious in just six minutes. The next day, Apple pushed an XProtect signature onto your Mac, without telling you.

The two events are likely connected. However, you’ll never know for sure. This incident has a name, TanStack. The mechanism that may have reacted on your Mac is called XProtect. You didn’t see anything, neither did I. Apple makes sure of that.

Welcome to the silent defense system of your Mac.

The TanStack Incident in 30 Seconds

On the evening of May 11th, 2026, the TanStack ecosystem, an ultra-popular JavaScript toolkit used by millions of developers (including those from OpenAI, Netflix, Shopify), was compromised. In six minutes, 170 packages were released with malicious versions. The most visible one, react-router, is downloaded 12 million times a week. In other words, a significant portion of the web that updates this week is getting infected without knowing it.

The malware is called Mini Shai-Hulud, a variant of the npm worm that has been around since 2024. Its target is whatever is on the developer’s Mac: passwords, cloud access keys, GitHub tokens, session files. On macOS, it installs itself discreetly and relaunches every time a session is opened. Clean, professional.

The worrying detail is the vector. The attacker didn’t steal any passwords or exploit any code flaws. They just submitted a false contribution to the open-source TanStack project, exploiting an imprudent automation system configuration.

Any contribution was executed with the real publication rights. A malicious pull request was enough to retrieve the signature token and publish 170 packages under the legitimate identity of the project. On npm’s side, everything seemed normal, signed, and verified. Stamped by TanStack itself.

OpenAI was affected by association, via one of its dependencies. Officially, there’s no proof of any product or user data compromise. But they still rotated all their applicative signature keys on macOS, iOS, Windows, and Android, and republished all their apps under new certificates.

You don’t do that when everything’s fine.

Apple reacted the next day. No communiqué, no notification, no tab in Settings. An XProtect signature was silently pushed. Macs picked it up over the hours, one by one, without telling anyone.

XProtect, Apple’s Silent Antivirus

XProtect is macOS’s integrated antivirus. It’s been there since Snow Leopard, and most users don’t even know it exists. That’s by design.

It works in two parts. The first is the signature engine: a file that macOS consults before executing a downloaded app to check if it matches a known malware. The second is XProtect Remediator, XPR, a scanner that runs in the background and inspects your disk for threats that are already installed. When it finds one, it neutralizes it.

Signatures are pushed by Apple via CloudKit, the same silent pipeline that synchronizes your iCloud photos and keychain. When a significant malware emerges, Apple compiles a signature, signs it, deposits it on CloudKit. Your Mac picks it up during the next check, usually within 24 to 72 hours.

No notification. No restart. No “your Mac has been updated” message. Apple made an editorial choice not to alarm users. The downside is that you have no way of knowing, at a glance, if you’re properly patched for the recent incident.

That’s where it gets interesting.

The Push 5344, May 12th, the day after TanStack

The XProtect version published on May 12th, 2026, is called 5344. The previous one, 5342, was from May 5th. Perfect temporal match with TanStack, one day later.

Except Apple never publicly documents the content of an XProtect signature. Howard Oakley, who dissects each release on eclecticlight.co, notes on 5344 “some adjustments on known malware families”. No TanStack or Shai-Hulud signature. Nothing officially saying “this is the response to yesterday’s incident”.

Coincidence or targeted reaction? Apple isn’t saying. That’s precisely what justifies looking into it.

Check in 30 Seconds if Your Mac is Patched

On macOS 15 Sequoia and macOS 26 Tahoe, Apple moved XProtect to a new location and provides a native command. That’s the recommended way. On macOS 14 Sonoma and earlier, the old location is still valid. I’ll give you both.

1. The XProtect signature version

On Sequoia and Tahoe:

sudo xprotect version

You’ll get a number like 5344 or 5347. That’s the signature base. The higher the number, the more recent it is.

On Sonoma and earlier:

defaults read /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info CFBundleShortVersionString

The old path still exists on Sequoia and Tahoe, but macOS doesn’t consult it first anymore. You can read it and get an outdated version while sudo xprotect version gives you the real one. That’s exactly the kind of trap that makes you think your Mac is behind when it’s not.

2. The XProtect Remediator version

defaults read /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/Info CFBundleShortVersionString

You’ll get a number like 157. That’s the scanner itself, updated much less often than the signatures.

3. The installation history

system_profiler SPInstallHistoryDataType | grep -A 2 -i xprotect

You’ll see all the XProtect versions installed with their dates. Great for checking if your Mac isn’t stuck on an old base because CloudKit has a problem.

To compare your version with what Apple publishes in real-time, the public tracker on Howard Oakley’s eclecticlight.co keeps the list up-to-date. Oakley is a British engineer who’s been dissecting macOS for fifteen years. He’s the reference on the subject.

And if your Mac is behind, force the check:

sudo xprotect update

On Sonoma and earlier, the old command sudo softwareupdate --background-critical still works.

At the time of publishing, the latest version is 5344, on May 12th, 2026. If your Mac shows less, your CloudKit channel is slow.

The Sovereign Downside

XProtect is a black box signed by Cupertino. You don’t know which signatures are pushed, what telemetry is sent back, or who decides that a binary is malicious. Apple decides, Apple pushes, your machine executes.

The mechanism is useful, very useful even. Blocking known malwares before they execute is the base of modern defense, and doing it without bothering you will prevent you from disabling it when you’re fed up with that rognutudju!! pop-up (look it up, if you’re under 50, you won’t get the reference).

The three commands above give you a minimal right to look into what your OS does without asking. It’s a small step towards sovereignty, not taking control back, just knowing.

The difference between a passive user and a sovereign user isn’t just in the tools they use. It’s also in the questions they ask. What version do I have? When was it pushed? What’s in it?

Apple answers the first two with three Terminal lines. On the third, they stay silent. It’s Howard Oakley who dissects the content afterwards and publishes the diffs on eclecticlight.co. You’ll never know directly what Apple has stamped as malicious that night.

Every month, I still check the XProtect versions on my Macs. Nothing heroic, just a habit. The day CloudKit’s channel screws up, I’ll have a reference point.

Read also: The macOS settings to change immediately

In Summary

XProtect is useful, silent, and out of your control. The topic is knowing that it exists, knowing the three commands that tell you where you stand, and understanding that in the 2026 JavaScript supply chain, like others, it patches the leaks.

Run the three commands. Note your numbers. Compare them to eclecticlight.co every now and then. It takes thirty seconds, and it lets you know if you’re properly patched and up-to-date.

Read also: Lockdown Mode vs. Coruña, the government spy toolkit

Technical terms? Check the glossary.