BlockBlock

BlockBlock runs continuously in the background on macOS and watches the system’s common persistence locations, such as login items, launch agents, and launch daemons. When a new component is added that could cause software to start automatically after a reboot or login, the tool generates an alert that details the responsible process, its identifier, path, arguments, and the file that was modified to achieve persistence.

The alert interface lets users inspect code‑signing information, view VirusTotal detections, and explore the process ancestry. Users can then choose to allow the change or block it, and the decision is remembered as a rule for future occurrences. Additional protections can be toggled in the settings, and the application integrates with macOS’s Endpoint Security Framework, requiring Full Disk Access and system privileges during installation.

BlockBlock is aimed at macOS users who want to monitor and control the creation of persistent components, helping to detect and prevent unwanted or malicious software from establishing automatic execution on the system. It is distributed as a stable, macOS‑only package and can be installed or removed via its status‑bar menu.