A NOTE FROM THE MAKER
Why I built
Verity.
It started with an incident on my own Mac.
Something was wrong.
One day, my Mac was under unusually heavy load. I looked into it and found a lot of find processes searching for credentials. I immediately disconnected it from the network.
I discovered an executable called download in /usr/local/bin. Commands to run it had also been added to my .zshrc and .bashrc files.
I had to search for those changes myself to understand how the malware was being launched. The modified startup files were a key part of that investigation.
I suspect an npm package was involved, but I have no proof. I still don’t know how it got there.
Disconnecting was only the first step.
As a precaution, I replaced my SSH keys and revoked all my API tokens. Even after cutting the network connection, I was left with uncertainty about what had happened.
That is why I built Verity.
Verity is built around making changes to sensitive locations visible: shell startup files, SSH configuration, launch agents, and executable directories.
It records an initial state, reports subsequent changes, and keeps encrypted versions of readable file contents where supported. When process attribution is available, it provides context for investigating a change. Optional Protect controls certain executions within its monitored scope.
If Verity had already been monitoring my .zshrc and .bashrc files, it would have surfaced those modifications directly. With readable before-and-after versions available, I could have inspected the added commands instead of first having to find which files had changed. That visibility does not require Protect to be enabled.
With Protect already enabled, /usr/local/bin in its monitored scope, and no matching trust rule, a new executable like download would have required my approval before running under my account. Blocking the request, or leaving it unanswered, would have blocked that execution.
That does not mean the entire incident would have been prevented. A file already present when Protect was enabled could have been part of its initial baseline. Monitoring alone, with Protect off, reports changes without blocking execution.
What I want Verity to offer is a clearer record of changes and, with Protect enabled, a chance to decide before a new executable in its scope runs.
Know what changed.
Have something concrete to investigate.