Overview
The Apple Supply Chain Scanner Policy installs swif-scan, Swif's supply chain scanner, on managed Macs. swif-scan looks for:
Exposed credentials: API keys, tokens, and private keys left in files, such as an AWS access key in a
.envfile. It can also check with the provider whether a key still works.Malicious packages: installed package versions that threat feeds list as malicious.
Vulnerable packages: installed packages with known vulnerabilities (CVEs).
The Swif agent installs, runs, updates, and removes swif-scan, and reports what it finds to Swif. swif-scan is built to stay light: it limits its own CPU use, so Macs stay usable during a scan.
Important: The full credential is never sent to Swif. When swif-scan finds a credential, it reports the type of key, where it was found, and a fingerprint. The key's value never leaves the Mac. If you turn on credential verification, swif-scan holds the key in memory only for the check with its provider.
Requirements
Requirement | Details |
Platform | macOS 13 or later |
Device ownership | Company-owned and BYOD |
Swif agent | Installed and running |
Full Disk Access | Granted automatically by the policy's profile, so swif-scan can read Desktop, Documents, and Downloads |
Network | Access to the advisory data sources (OSV, Aikido, Datadog, and VSX Sentry), and to credential providers if verification is on |
How it works
You assign the policy to your Macs.
Each Mac gets a profile with the scanner's settings, and Full Disk Access for swif-scan.
The Swif agent installs swif-scan, signed by Swifteam Inc., in
/usr/local/swif-scan/.The agent runs a scan once a day, in the background.
The agent collects the results, and sends them to Swif.
The scanner maintains itself
Situation | What happens |
Nothing changed since the last report | The report isn't sent again. Unchanged results are re-sent after 7 days. |
You edit the policy | swif-scan isn't reinstalled. New settings apply from the next scan. |
swif-scan is modified on the Mac | The agent replaces it with a clean, signed copy within 10 minutes. |
A new swif-scan version is released | The agent updates it within 6 hours, but never during a running scan. |
You unassign the policy | Within about 2 minutes, any running scan is stopped, and swif-scan and its data are removed from the Mac. |
Settings reference
Credentials
Setting | What it does | Default | Range |
Scan for Credentials | Looks for API keys, tokens, and private keys in files on the Mac | On | — |
Largest File to Read (MB) | swif-scan skips files larger than this, and reports them as not checked, not as clean. | 16 | 0–512 |
Verify Credentials with Their Provider | Asks each key's provider whether the key still works, so you can tell a live key from a revoked one | On | — |
Providers Not to Ask | Providers swif-scan never contacts, for example for contractual reasons. Their keys are reported as unverified. Shown when verification is on. | Empty | Letters, digits, |
Verification Timeout (seconds) | How long swif-scan waits for one provider's answer. A check that times out is reported as failed, not as invalid. Shown when verification is on. | 10 | 1–60 |
About verification
Provider audit logs: the checks appear in each provider's audit logs, for example in AWS.
Proxies: checks may fail behind a proxy that blocks them.
How Providers Not to Ask matches: an entry such as
awsorgithubcovers every detector whose name starts with it.google,amazon,microsoft,hashicorp,vault,1password,xai, andcrates.ioalso cover their related detectors.
Packages
Setting | What it does | Default |
Check for Malicious Packages | Matches installed packages against known malicious packages from OSV, Aikido, Datadog, and VSX Sentry. Covers npm, PyPI, RubyGems, Go, Maven, and more, plus VS Code extensions. | On |
Check for Vulnerable Packages | Also matches installed packages against known vulnerabilities (CVEs) | Off |
A malicious package finding means remove the package. Upgrading it isn't enough.
Plan before turning on vulnerability checks. They can report hundreds of findings on one Mac. Decide how your team will review and prioritize them first.
Where to scan
Setting | What it does | Default |
Folders to Scan | The folders swif-scan checks for credentials and project packages, as absolute paths, such as | Empty (every user's home folder) |
Mask File Paths | Findings show a masked path instead of the full one, so user, customer, and project names in paths don't reach Swif. Finding the file to fix gets harder. | Off |
Folders to Scan doesn't limit package checks. swif-scan also checks software installed system-wide, such as under /usr/local, /opt, and /Library, and packages installed globally with tools like npm and gem. These are checked even if they're outside Folders to Scan.
Advisory data
swif-scan downloads advisory data for each package ecosystem it finds on the Mac. After the first download, it downloads only what changed. The first download can be large: in testing, it was 291 MB, and npm's data alone can be over 200 MB.
Setting | What it does | Default | Range |
Advisory Data Mirror | Where swif-scan downloads OSV's advisory data from. Leave empty to download from OSV directly. | Empty | An |
Disk Budget for Advisory Data (MB) | The disk space swif-scan can use for advisory data. An archive that doesn't fit is refused, and the check it's for is reported as failed. | 512 | 64–8,192 |
Using a mirror. A mirror must serve OSV's own layout (<url>/ecosystems.txt and <url>/<ecosystem>/all.zip), and must be kept up to date. It doesn't make the download smaller. Malware lists from Aikido, Datadog, and VSX Sentry are still downloaded from their own sites.
Performance
Setting | What it does | Default | Range |
CPU Budget (% of one core) | swif-scan pauses as needed to stay under this share of one CPU core. A lower budget makes scans take longer. | 15 | 1–35 |
Longest Scan (hours) | A scan that runs out of time stops, and is reported as partial. The next scan continues where it left off. A partial scan never marks an earlier finding as resolved. | 6 | 1–12 |
In testing, a scan took about 4.5 minutes, with an average CPU use of 15% of one core and peak memory of 135 MB.
What's reported
Section | Details |
Coverage | Which checks ran, and which the policy turned off |
Credentials | The type of key (such as an AWS access key), the file and line number, a fingerprint, a short prefix of the key, the verification result, and when it was first and last seen. Never the full key. |
Package findings | Whether each package is malicious or vulnerable, its ecosystem (such as npm or PyPI), version, and location, the advisory and CVE IDs, severity, and why it matched, such as "exact version 2.19.0 is listed as affected" |
Scan statistics | Duration, folders scanned, files checked, average and peak CPU use, and peak memory |
Before you start
Check your network. Make sure Macs can reach the advisory data sources, and credential providers if verification is on. If you use a proxy, check that it allows these requests.
Decide on credential verification. Verification shows which keys still work, but the checks appear in providers' audit logs. List any providers swif-scan shouldn't contact in Providers Not to Ask.
Plan for findings. Decide who will act on exposed credentials and malicious packages. If you turn on vulnerability checks, plan how to handle a large number of findings.
Consider privacy, especially on BYOD Macs. Turn on Mask File Paths if file paths could contain personal or customer names.
Choose a pilot group of Macs.
Create the policy
In Swif, go to Device Management > Policies, then select Create new policy > Configure a Policy.
Select Apple Supply Chain Scanner Policy.
Enter a clear name, such as
Supply Chain Scanner – Pilot.Review the settings. The defaults suit most organizations.
Save the policy.
Assign it to your pilot Macs.
Example configurations
Example 1: Find exposed credentials and malicious packages (defaults)
Setting | Value |
Scan for Credentials | On |
Verify Credentials with Their Provider | On |
Check for Malicious Packages | On |
Check for Vulnerable Packages | Off |
The recommended starting point. You'll see exposed keys, whether they still work, and any malicious packages, without a large number of vulnerability findings.
Example 2: Privacy-focused scanning for BYOD Macs
Setting | Value |
Scan for Credentials | On |
Verify Credentials with Their Provider | Off |
Check for Malicious Packages | On |
Folders to Scan |
|
Mask File Paths | On |
Scans only shared project folders, doesn't contact providers, and masks file paths in findings. System-wide packages are still checked.
Example 3: Developer Macs with vulnerability checks
Setting | Value |
Check for Malicious Packages | On |
Check for Vulnerable Packages | On |
CPU Budget (% of one core) | 25 |
Disk Budget for Advisory Data (MB) | 2048 |
Adds vulnerability findings, with more CPU and disk space for large projects.
Verify the policy
In Swif, open the device, and confirm that the policy shows as applied.
On the Mac, check that swif-scan is installed:
ls /usr/local/swif-scan/
Wait for the daily scan to finish. Results reach Swif shortly after.
Troubleshooting
Credential checks show as failed
The provider didn't answer within Verification Timeout (seconds). A failed check doesn't mean the key is invalid.
A proxy may be blocking the requests. Check that Macs can reach the providers.
A package check shows as failed
The advisory data didn't fit in Disk Budget for Advisory Data (MB), or couldn't be downloaded. Increase the budget, or check that Macs can reach the advisory data sources.
A scan is reported as partial
It ran longer than Longest Scan (hours). The next scan continues where it left off. Raise Longest Scan (hours) or CPU Budget (% of one core) if scans regularly don't finish.
Package findings come from outside Folders to Scan
This is expected. Folders to Scan limits credential and project checks, but swif-scan also checks software installed system-wide and global packages.
A file shows as not checked
It's larger than Largest File to Read (MB), or it's outside Folders to Scan. Increase the limit, set it to 0 for no limit, or add the folder.
A security tool flags swif-scan
Add /usr/local/swif-scan/ to your security tool's exclusions. For CrowdStrike Falcon, see Configuring CrowdStrike Falcon Exclusions for Swif.ai.
swif-scan is still on a Mac after I removed the policy
Removal takes about 2 minutes after the policy is unassigned. Check that the Mac is online, and has received the change.