[BUG] "Malicious Script Blocked" — embedded image-processor.node is unsigned when extracted, trips XProtect YARA (macOS 26.5, XProtect 5355)

Preflight

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

On macOS 26.5.1 with XProtect signature version 5355, using Claude Code triggers a system-modal Gatekeeper dialog:

Malicious Script Blocked A script was blocked because it contains malware. This script did not harm your Mac.

Unified-log analysis traces this to image-processor.node, a native addon embedded in the Claude Code single-file binary. Because Claude Code is a Bun-compiled executable, the addon is extracted to a temp path at runtime (when handling a pasted image). The extracted copy carries no code signature of its own, so Gatekeeper cannot match it to the parent's notarization and falls through to a raw XProtect YARA content scan — which matches a rule and blocks it.

The parent binary itself is correctly signed and notarized:

Identifier=com.anthropic.claude-code
TeamIdentifier=Q6L2SF6YDW
spctl: accepted — source=Notarized Developer ID
       origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

This appears to be the residual case of #60799 (main binary notarization, now fixed) — the embedded native addons are still unsigned once extracted.

This is not fixable by the user: XProtect YARA blocks cannot be allow-listed the way quarantined files can (there is no com.apple.quarantine xattr to remove). Downgrading does not help either — image-processor.node is present in every version I have installed (2.1.220, 2.1.221, 2.1.226, 2.1.231), so this is a new XProtect signature firing on long-standing content, not a regression in a specific release.

What Should Happen?

Pasting an image into Claude Code should not raise a system malware dialog. The embedded native addons should either be code-signed individually so the extracted copies inherit a valid signature, or extracted in a way that preserves the parent's Gatekeeper verdict.

Error Messages/Logs

syspolicyd (PID 657), each block prompt preceded 1:1 by a scan of image-processor.node:

11:14:58.086  GK performScan: PST: (path: d48ef3eeb8400087), (team: (null)), (id: (null)), (bundle_id: (null))
11:14:58.105  Error Domain=GatekeeperPolicyScanError Code=-67018 "Code did not match any currently allowed policy"
11:14:58.254  GK evaluateScanResult: 2, PST: (path: d48ef3eeb8400087), (team: (null)), (id: image-processor.node), (bundle_id: NOT_A_BUNDLE)
11:15:33.179  Displaying XProtect blocked prompt: type=19, uid=501     <-- dialog

11:16:16.421  GK evaluateScanResult: 2, PST: (path: 25d5bb16200a3416), (team: (null)), (id: image-processor.node), (bundle_id: NOT_A_BUNDLE)
11:16:43.866  Displaying XProtect blocked prompt: type=19, uid=501     <-- dialog

11:19:36.629  GK evaluateScanResult: 2, PST: (path: d49ff2c45db3ff83), (team: (null)), (id: image-processor.node), (bundle_id: NOT_A_BUNDLE)

Corresponding YARA scan by XprotectService:

11:14:58.151  [com.apple.xprotect:xprotect] Using XProtect rules location:
              /var/protected/xprotect/XProtect.bundle/Contents/Resources/XProtect.yara

The addon is confirmed embedded in the shipped binary:

$ strings -a ~/.local/share/claude/versions/2.1.231 | grep -c "image-processor.node"
6

Note: file paths are hashed and marked <private> in the logs, so I cannot name the specific YARA rule. The image-processor.node attribution comes from the scan-to-prompt correlation, which held for every occurrence in the window.

Steps to Reproduce

1. On macOS 26.x with XProtect signature version 5355 (YARA DB dated 2026-08-11), install Claude Code via the native installer.
2. Start claude in a terminal.
3. Paste or attach a screenshot into the prompt.
4. Within ~30s, the "Malicious Script Blocked" dialog appears. It recurs on subsequent cold starts that touch image handling.

Claude Code Version

2.1.231 (native install, ~/.local/share/claude/versions/)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other (Ghostty)

Additional Information

• macOS 26.5.1 (build 25F80), arm64
• XProtect bundle version 5355; active YARA DB at /var/protected/xprotect/ dated 2026-08-11 11:05. The system copy at /Library/Apple/System/Library/CoreServices/XProtect.bundle/ is dated 2026-08-06, so the 08-11 signature update is the likely trigger.
• Impact is degraded-but-working: the addon fails to load and Claude Code appears to fall back to a JS path — pasted images still reach the model. The main cost is a recurring system-modal malware warning, which is alarming and would be a blocker in managed/enterprise fleets where such dialogs get escalated to security teams.
• Worth reporting the extracted addon to Apple as a false positive in parallel, but signing the embedded .node files is the fix that does not depend on Apple's turnaround.