What is ShipIt?


I use RansomeWhere? on my mac and it has shown that Brave was encrypting the cache. After allowing it to do so, it has shown that something called ShipIt is encrypting files? I can understand and accept that Brave might have a need to do this, but what is ShipIt/ why is it encrypting anything concerning the Brave browser?


It looks like ShipIt is used by Squirrel.mac. Like most other electron based apps we use Squirrel.mac for our updates.

Here’s a point of reference:

I don’t know how it works myself but you could try filing a question on that repo.


Hi Brian,

Thanks for replying. I appreciate the explanation for this process. Is encryption typically part of the updating process? Sorry I am relatively new to the inner workings of updating processes. I ask because I don’t notice this behavior when other apps receive updates.


This is the pop up that RansomeWhere? displayed

after selecting the Brave update:


Is RansomWhere saying that the files are being encrypted or locked? Looks like the latter from that screenshot.

closed #6