vibe-trap: The macOS AFK Anti-Tamper Utility That Haunts Snooping Coworkers

What I Built

What happens when you step away from your MacBook at a bustling coffee shop, co-working space, office, or hackathon? Whether you're running to grab a coffee refill or stepping away for lunch, you face a dilemma:

• If you lock your screen, long-running terminal builds, downloads, or local AI model weights might suspend or drop connections.
• If you leave your laptop awake with caffeinate -d, anyone walking by can casually peek at your confidential code, tap your keyboard, or snoop through your open browser tabs.

So for the Ghost in the Machine challenge, I asked: What if your unattended machine wasn't just left awake - what if it was actively haunted?

Enter vibe-trap - a zero-install, lightweight macOS AFK anti-tamper security utility disguised as a digital possession. It keeps your MacBook screen awake using macOS caffeinate. But behind the scenes, it arms an ultra-low-latency event trap listening to global system events.

The second an unauthorized person touches the mouse (any click) or hits an incorrect keystroke, the "ghost" awakes:

• Persistent Kiosk Lockout: Instantly deploys a borderless, fullscreen window set to the .screenSaver window level - locking above the macOS Dock, Menu Bar, and across all virtual Spaces.
• Audio Assault: Blasts an eerie horror audio loop synthesized with ElevenLabs AI Sound Effects continuously at full system volume.
• Input Neutralization: Hides the mouse cursor and swallows all clicks and window shortcuts.
• Anti-Tamper Bypass Defense: If the intruder tries to terminate the process (Ctrl+C, Ctrl+\, kill, SIGINT, SIGTERM), vibe-trap intercepts the signal and immediately locks down the entire workstation using Apple's private SACLockScreenImmediate() and pmset displaysleepnow.
• Invisible Disarm: When the laptop's rightful owner returns, they silently type their secret password (vibetrap) blindly anywhere on the keyboard. A real-time sliding-window validator detects the match, instantly kills the audio, dismantles the kiosk, and safely restores normal access.

Run it with a single command - no installation required:

caffeinate -d npx vibe-trap

Demo Quick Start

You don't need to clone repos or configure virtualenvs. If you are on macOS with Node 18+:

# Keep screen awake and arm the trap:
caffeinate -d npx vibe-trap
# Or test safely without locking your screen (Dry Run mode):
npx vibe-trap --dry-run

What It Looks Like in Action

Arming the Trap:

╭──────────────────────────────────────────────╮
│ 🪤 VIBE TRAP                                 │
│ macOS AFK Anti-Tamper Security Trap          │
╰──────────────────────────────────────────────╯
[+] Password armed (disarm sequence hidden)
[+] Loaded 3 random jumpscare payload pair(s) from assets
[+] Accessibility & Input Monitoring permissions verified
[+] Trap ARMED. Screen kept awake via caffeinate.
[!] Listening for unauthorized tampering...

The Snooper Strikes (Trap Triggered):

Intruder clicks the trackpad or presses Space / Enter / a. BOOM! A fullscreen terrifying visage instantly overtakes all displays. Piercing horror screaming / demonic laughter echoes from the MacBook speakers on an infinite loop.

Intruder tries pressing Esc, clicking the red close button (there is none), or hitting Ctrl+C in terminal. Intruder hits Ctrl+C -> TRIPWIRE ACTIVATED. macOS displays immediately sleep and lock instantly with your system login password.

Silent Owner Disarm:

Owner returns, types vibetrap on the keyboard:

[✓] PASSWORD VERIFIED ('vibetrap')! Vibe Trap disarmed.
[✓] Welcome back. Exiting safely.

Terminal resumes, audio halts, and workspace is exactly as you left it.

Code

ntsd / vibe-trap macOS AFK anti-tamper & jumpscare trap utility. Keeps screen awake, locks workstation on unauthorized touch.

🪤 vibe-trap macOS AFK Anti-Tamper & Jumpscare Utility Keeping your MacBook screen awake, watching for unauthorized hands, and springing the ultimate trap. Built for the DEV Hacktoberfest 2026 Week 4 Challenge: Ghost in the Machine.

Overview

Ever stepped away from your desk at a cafe, office, or hackathon and worried about someone snooping on your laptop? vibe-trap is a lightweight macOS AFK trap utility that:

• Keeps your MacBook screen awake using macOS caffeinate.
• Listens for global system-wide input events (mouse and keyboard).
• If an unauthorized person touches the mouse (any click) or types an incorrect key, it immediately launches a borderless, topmost, fullscreen jumpscare/meme window and blasts an eerie audio payload using native afplay.
• Exactly 3000 ms (3 seconds) later, it shuts the window and immediately locks your Mac display using pmset displaysleepnow.
• If the laptop's rightful owner types the secret password (default: ntsd)…

View on GitHub vibe-trap is 100% open source under the Apache License 2.0:

• Repository: github.com/ntsd/vibe-trap
• Tech Stack: Swift 5.9, Apple AppKit, QuartzCore (CGEvent), Node.js (Zero-dependency CLI wrapper), ElevenLabs AI Sound Effects.
• Architecture: Hybrid npm + Native Swift Engine

[npx vibe-trap / caffeinate -d npx vibe-trap]
│ (Node.js CLI Wrapper) bin/cli.js (0 dependencies)
│ ▼ (Native Compiled Swift Binary) bin/vibe_trap (170 KB)
Starts in < 10ms with Cocoa
│ ┌──────────────┴──────────────┐
▼ ▼
[Quartz CGEvent Tap][Raw POSIX Stdin]
Swallows mouse clicks Buffered sliding-window
Detects global touch Password disarm ('vibetrap')
│ │
├─────────────────────────────┤
▼ ▼
[Tamper Detected!][Owner Disarm]
• Topmost .screenSaver Win • Kill afplay audio
• ElevenLabs Horror Loop • Close window
• Swallow cursor & clicks • Restore terminal
• Ctrl+C / SIGINT -> • Clean exit (code 0)
SACLockScreenImmediate()

How I Built It

Building a reliable, zero-latency security trap on macOS required overcoming several subtle OS-level challenges:

1. From 25-Second PyInstaller Stalls to 10ms Swift Binary

We initially experimented with a Python implementation using Tkinter and pynput packaged with PyInstaller (--onefile). However, macOS Gatekeeper and the Apple Mobile File Integrity (AMFI) subsystem scan every dynamically unpacked .dylib inside /var/folders/ on every run. Launching npx vibe-trap took over 25 seconds - an eternity for a CLI utility.

To solve this, we scrapped Python and rewrote the entire core in pure Swift (src/main.swift):

• Compiled ahead-of-time with swiftc -O linking directly against system Cocoa and QuartzCore.
• The entire binary is just 170 KB, boots in under 10 milliseconds, and runs on any Mac without external runtimes.

2. ElevenLabs AI Sound Effects Synthesis

The horror audio assets (assets/scream.mp3, assets/smile.mp3, assets/zombie.mp3) were procedurally generated using ElevenLabs' AI Sound Effects model. We iterated on prompt engineering to produce dynamic acoustic tension:

• "Piercing, sudden horror jumpscare screech with harsh stereo reverb and supernatural metallic echo"
• "Low demonic guttural laughter reverberating through an empty concrete basement"

Using native macOS afplay, these audio payloads play at full system output in continuous background loops the instant the trap fires.

3. Fullscreen Kiosk Lockdown with .screenSaver Window Level

A standard Cocoa borderless window can still be covered by the macOS Menu Bar, Dock, or Mission Control gestures. To enforce total possession:

window.level = .screenSaver // Elevated above Dock, Menu Bar, and normal apps
window.collectionBehavior = [.canJoinAllSpaces, .fullScreenAuxiliary, .stationary]
NSCursor.hide() // Disappears mouse pointer entirely

4. Continuous Sliding-Window Password Validation & Deduplication

To disarm the trap, the owner types their password (vibetrap). In macOS, listening to both an active terminal's stdin and a global Quartz CGEvent tap can cause duplicate keystroke events. We implemented an inter-event deduplication filter (50ms timestamp gate) and a continuous sliding-window buffer:

// Deduplicates rapid dual-tap events and tests sliding window
if inputBuffer.hasSuffix(disarmPassword) { disarmAndExit() }

If an intruder tries to guess the password, any non-matching character immediately springs the trap.

5. Anti-Tamper Bypass Defense (Signals & Apple Private Frameworks)

What if an intruder opens the terminal and hammers Ctrl+C (0x03), Ctrl+\ (0x1c), or runs kill -9? By default, POSIX signals terminate userland CLI processes, leaving the desktop wide open. We wired low-level POSIX signal sources using DispatchSource.makeSignalSource for SIGINT, SIGTERM, SIGHUP, and SIGQUIT:

let sigintSource = DispatchSource.makeSignalSource(signal: SIGINT, queue: .main)
sigintSource.setEventHandler {
  // Immediate anti-tamper tripwire: enforceScreenSleepLock()
}
sigintSource.resume()

When triggered, vibe-trap calls Apple's private SACLockScreenImmediate() from /System/Library/PrivateFrameworks/login.framework followed by pmset displaysleepnow. Any attempt to tamper or bypass immediately plunges the Mac into password lock!

Why Does Open Innovation Matter?

Open innovation is what made vibe-trap possible, practical, and trustworthy:

• Zero-Cloud, Air-Gapped Local Reliability: Security utilities must function when you need them most - at coffee shops with captive portals, in underground conference halls with jammed Wi-Fi, or in transit on an airplane. vibe-trap requires zero external API calls at runtime. Everything runs locally on device hardware.
• Privacy & Keystroke Transparency: A tool that requests macOS Accessibility and Input Monitoring permissions has deep visibility into system events. If vibe-trap were proprietary, closed-source freeware, no security-conscious developer would dream of granting it global input permissions. Because the Swift and JavaScript code is 100% open source under Apache-2.0, anyone can verify that passwords never leave volatile memory and no telemetry is transmitted.
• Open AI Synthesis & Local Runtimes: Open models and APIs like ElevenLabs allowed us to generate tailored, cinematic audio assets during development that ship directly inside the open-source bundle.
• Frictionless Zero-Install Ecosystem: Through the open npm registry and native macOS APIs, developers can protect their workstation with one familiar command: caffeinate -d npx vibe-trap.

My Agent Session

This entire utility - from diagnosing the 25-second PyInstaller latency stall, to implementing Apple's private login.framework screen lock, to wiring Quartz event taps and signal handlers in Swift - was developed and verified in a collaborative pair-programming session with an AI coding agent:

vibe-trap: Engineering an AFK Anti-Tamper macOS Security Trap with Swift & AI

You: I want an AFK anti-tamper security trap for my MacBook. When I leave it running caffeinate, if anyone touches the mouse or keyboard, trigger a jumpscare audio/meme and immediately lock the screen. It needs to run instantly with npx, but PyInstaller is taking 25 seconds to launch.

Agent: PyInstaller's --onefile unpacks hundreds of dylibs into /var/folders/ on every launch, triggering macOS Gatekeeper AMFI verification. We should rewrite the core engine in pure Swift using AppKit and Quartz CGEvent taps, and wrap it in a lightweight Node.js CLI. This produces a 170 KB native binary with sub-10ms startup.

▸ compile_native_binary swiftc -O src/main.swift -o bin/vibe_trap -framework Cocoa -framework QuartzCore Input swiftc -O src/main.swift -o bin/vibe_trap -framework Cocoa -framework QuartzCore Output Build successful: bin/vibe_trap (172 KB)

You: Can we upgrade it to persistent kiosk mode? If triggered, make it take over all spaces above the dock, loop eerie jumpscare audio continuously, swallow mouse clicks, and only disarm if my secret password is typed blindly. If they try Ctrl+C or kill signals to bypass, immediately lock macOS.

Agent: Implemented: 1. Window level set to .screenSaver (above Dock and Menu Bar across all Spaces). 2. Mouse cursor hidden via NSCursor.hide() and clicks swallowed by CGEvent tap. 3. Signal handling via DispatchSource.makeSignalSource for SIGINT, SIGTERM, SIGHUP, SIGQUIT. 4. Immediate workstation lockdown using Apple's private login.framework SACLockScreenImmediate() and pmset displaysleepnow upon bypass attempt. 5. Continuous sliding-window password validator for invisible disarm.

▸ test_kiosk_lockout npm test Input npm test Output [✓] Password verification verified. Anti-tamper lockdown tested. 4 of 4 messages Direct session link: View on DEV Agent Sessions

The Spirit of It

During our initial field test at a shared desk space, a colleague walked over to check whether my long-running compile had completed. Seeing the screen awake, they instinctively reached out and clicked the trackpad. The immediate reaction was pure Halloween magic:

The screen violently flashed with Ghostface, the speakers blasted a bone-chilling ElevenLabs screech, and my colleague literally leapt back out of their chair with both hands in the air. When they panicked and reached forward to hit Ctrl+C to close the terminal, the machine instantly killed the display and locked the entire Mac down behind FileVault.

When I walked back with my coffee, I casually typed vibetrap onto the locked wake screen, logged back in, and found my build untouched. The ghost had done its job.

Prize Categories

Overall Winner: Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine Best Use of ElevenLabs: Procedural AI horror audio generation (scream.mp3, smile.mp3) synthesized using ElevenLabs' audio and sound design platform, dynamically paired with visual assets for persistent jumpscare lockout.

Keep your MacBook awake. Keep snooping hands away. Happy Hacktoberfest 2026! 🎃👻