Remote Access
Checks built-in Remote Login, Remote Apple Events, Screen Sharing, Remote Management, plus a watchlist of remote-access/RMM applications and processes.
Read-Only macOS Security Inspection
Threat Inspection
Threat Inspection is a read-only technician security inspection for macOS. It reviews remote-access software, PUP/PUA indicators, persistence, processes, recent suspicious files, browser settings, network state, and macOS security controls, then creates an HTML report on the Desktop.
Installation
Using the Melding Software Mac installer
Copy and paste this command into Terminal to install the Melding Software Mac scripts.
After reopening Terminal, type MeldingSoftware anytime to load the list.
curl -fsSL https://raw.githubusercontent.com/MeldingSoftware/Scripts/main/Mac/install.sh | bash
Because this command downloads and immediately runs a shell installer, you can review install.sh in the GitHub repository before executing it. Individual scripts may also request permissions, administrator access, Keychain authorization, Full Disk Access, or other macOS approvals depending on what the selected tool needs.
Documentation
Eight inspection areas
Programs & Login Items
Checks installed/running PUP/PUA watchlist matches, enumerates application context, Login Items, and background-task management context.
LaunchAgents / Persistence
Reviews third-party/user LaunchAgents and LaunchDaemons, unusual or missing targets, signatures, crontab entries, and rc.local.
Background Services / Processes
Targets running executables from user-writable/temp locations and inventories system extensions.
Suspicious Files
Groups watchlist artifacts and reviews recent scripts/installers/archives in selected user-writable locations.
Browsers
Enumerates Chromium extensions, selected homepage/notification settings, Firefox notification permissions, and notes Safari privacy limitations.
Network
Reviews proxy state, DNS, interfaces/VPN context, hosts entries, Application Firewall settings, and watchlist-related established TCP connections.
macOS Security
Reports security products, Gatekeeper, SIP, FileVault, XProtect/MRT context, software/security update preferences, and management enrollment status.
Documentation
Finding levels
Info
Inventory or contextual information.
Good
Expected security-state findings.
Review
Items that should be verified in context.
Warning
Stronger-risk indicators such as watchlist matches or selected unsafe states.
Antivirus summary
The report includes Apple XProtect plus recognized third-party security products it detects.
Documentation
Read-only behavior
No threat removal
The inspection does not remove, quarantine, or remediate the items it finds.
No inspected setting changes
Security settings being inspected are not changed by the inspection logic.
Clickable report helper
A small per-user URL-handler app is installed under the user's Library/Application Support so report links can open related Finder, System Settings, or Activity Monitor locations.
Temporary work directory
Working data is created under /tmp and removed when the script exits.
Documentation
Options and report
Recent-days option
--recent-days accepts 1 through 365 days; the default is 30.
No-open-report option
--no-open-report creates the report without automatically opening it.
Desktop HTML
The report is saved as Threat Inspection MM-DD-YY.html on the logged-in user's Desktop.
Administrator access
The script elevates with sudo so it can inspect system-wide persistence and security state.
FAQ
Frequently asked questions
Does Threat Inspection remove malware?
No. It is an inspection/reporting tool, not a malware-remediation engine.
What does Warning mean?
It marks a stronger risk indicator that still requires context and verification; a warning is not automatically proof of malware.
Does it scan every file like antivirus?
No. The file section performs a targeted recent-file and watchlist-oriented review.
Why might browser coverage be incomplete?
macOS privacy/TCC restrictions can block some browser data unless the terminal environment has sufficient access.
Where is the report saved?
On the logged-in user's Desktop as a dated HTML report.