
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
Package trayhost is a cross-platform Go library to place an icon in the host operating system's taskbar.
On macOS, for Notification Center user notifications to work, your Go binary that
uses trayhost must be a part of a standard macOS app bundle.
Most other functionality of trayhost will be available if the binary is not a part
of app bundle, but you will get a terminal pop up, and you will not be able to
configure some aspects of the app.
Here's a minimal layout of an app bundle:
$ tree "Trayhost Example.app"
Trayhost\ Example.app
└── Contents
├── Info.plist
├── MacOS
│ └── example
└── Resources
└── Icon.icns
Here's a minimal Info.plist file as reference (only the entries that are needed,
nothing extra):
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleExecutable</key>
<string>example</string>
<key>CFBundleIconFile</key>
<string>Icon</string>
<key>CFBundleIdentifier</key>
<string>ExampleApp</string>
<key>NSHighResolutionCapable</key>
<true/>
<key>LSUIElement</key>
<string>1</string>
</dict>
</plist>
CFBundleIdentifier needs to be set to some value for Notification Center to work.Contents/MacOS directory for Notification Center to work.NSHighResolutionCapable to enable Retina mode.LSUIElement is needed to make the app not appear in Cmd+Tab list and the dock
while still being able to show a tooltip in the menu bar.On macOS, when you run an app bundle, the working directory of the executed process
is the root directory (/), not the app bundle's Contents/Resources directory.
Change directory to Resources if you need to load resources from there.
ep, err := os.Executable()
if err != nil {
log.Fatalln("os.Executable:", err)
}
err = os.Chdir(filepath.Join(filepath.Dir(ep), "..", "Resources"))
if err != nil {
log.Fatalln("os.Chdir:", err)
}
go get -u github.com/shurcooL/trayhost
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.