Issue Station
Sign In
Tools hereToolbox

codex - 💡(How to fix) Fix macOS XProtect false positive: Sparkle Updater.app flagged as malware

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

macOS XProtect/syspolicyd is flagging the bundled Sparkle auto-updater (org.sparkle-project.Sparkle.Updater) inside Codex.app as malware and repeatedly attempting to move it to the trash.

Root Cause

macOS XProtect/syspolicyd is flagging the bundled Sparkle auto-updater (org.sparkle-project.Sparkle.Updater) inside Codex.app as malware and repeatedly attempting to move it to the trash.

Code Example

syspolicyd: [com.apple.syspolicy.exec:default] Attempting to move malware to trash: PST: (path: cd7aa078cc36520d), (team: 2DC432GLL2), (id: org.sparkle-project.Sparkle.Updater), (bundle_id: org.sparkle-project.Sparkle.Updater)

---

log show --predicate 'eventMessage CONTAINS "malware" AND eventMessage CONTAINS "updater"' --last 24h --info
RAW_BUFFERClick to expand / collapse

Summary

macOS XProtect/syspolicyd is flagging the bundled Sparkle auto-updater (org.sparkle-project.Sparkle.Updater) inside Codex.app as malware and repeatedly attempting to move it to the trash.

Details

  • Affected component: Codex.app/Contents/Frameworks/Sparkle.framework/Versions/B/Updater.app
  • Bundle ID: org.sparkle-project.Sparkle.Updater
  • Team ID: 2DC432GLL2 (OpenAI, L.L.C.)
  • macOS version: Sequoia
  • Code signing: Valid Developer ID Application certificate, hardened runtime enabled

Reproduction

The syspolicyd log shows repeated attempts (every ~15 minutes) to quarantine the updater:

syspolicyd: [com.apple.syspolicy.exec:default] Attempting to move malware to trash: PST: (path: cd7aa078cc36520d), (team: 2DC432GLL2), (id: org.sparkle-project.Sparkle.Updater), (bundle_id: org.sparkle-project.Sparkle.Updater)

This can be observed by running:

log show --predicate 'eventMessage CONTAINS "malware" AND eventMessage CONTAINS "updater"' --last 24h --info

Expected behavior

The Sparkle Updater.app bundled with Codex.app should not be flagged by XProtect/syspolicyd.

Possible fix

This may require re-notarizing the Sparkle framework bundle or updating to a newer Sparkle release that is not matched by the current XProtect signature definitions.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

The Sparkle Updater.app bundled with Codex.app should not be flagged by XProtect/syspolicyd.

#embedding generation#cache error#pipeline error#runtime error#dependency conflict

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

codex - 💡(How to fix) Fix macOS XProtect false positive: Sparkle Updater.app flagged as malware