"node" cannot be opened because the developer cannot be verified

[milleron]

As soon as I upgraded from Mojave 10.14.6 to Catalina 10.15.2, I started getting the rapidly recurring message box stating:

“node” cannot be opened because the developer cannot be verified
macOS cannot verify that this app is free from malware.
Safari.app downloaded this file on August 2, 2016.

The options given in the message box are "Move to Trash" and "Cancel."
Clicking "Cancel" leads to the nearly instantaneous reappearance of the same message box.
Clicking "Move to Trash" produces a message box stating:
"node" could not be moved to Trash.
Please move this item to the trash manually.

Searching in Finder on the Macintosh HD finds thousands of files that "match," NONE of which is named simply "node."
Searching in Applications and Downloads finds hundreds and hundreds of files that "match," none of which is named simply, "node," and none seems to even contain the word, "node." So I cannot delete "node" manually.

Googling "'node' cannot be opened because the developer cannot be verified" yields no relevant results.

Rebooting the iMac does not stop the offending error message from appearing.

HOW to troubleshoot this weird behavior??

 

[milleron]

I'm replying to my own question here. I also looked on the Apple macOS forum after posting here, and I found that at least 10 of the folks on a thread about this exact problem found a folder named, "ATT" in Macintosh HD/Library/Application Support. Removing it stopped the nasty recurring error messages.

I had NO clue that this might be the problem, but it worked a treat for me, too. The people suffering from the problem had AT&T as an ISP provider presently or in the past.

 

[frou]

"node" most likely refers to NodeJS. AT&T probably provided some kind of non-essential helper tool written in JavaScript, that needed an update to keep working but had no way to self-update itself.

 

[bry2k]

"node" most likely refers to NodeJS. AT&T probably provided some kind of non-essential helper tool written in JavaScript, that needed an update to keep working but had no way to self-update itself.

Good info. Charter Spectrum cable company installs the same kind of crap for its web player plugin.

Here's the thing - if you delete software in /Library/Application Support, you're not deleting the thing that tries to launch that software every time you boot your machine.

Look in these folders:

/Library/LaunchAgents
/Library/LaunchDaemons
~/Library/LaunchAgents
~/Library/LaunchDaemons

What you'll find in there are all the plists used by launchctl to launch background programs belonging to various software you may have installed, any or all of which may need an upgrade to run in Catalina. Most of the plists will be obvious from their filename corresponding to software you're aware of having installed, but some plists will have nonsensical names. In that case, you can view the plist contents by dropping the plist file on TextEdit (or Xcode or any text editor app - I like Sublime) to see the contents.

As one example, I have this file:

/Library/LaunchDaemons/NkPtpEnumWT3.plist

Contents of the file:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>jp.co.nikon.NkPtpEnumWT3</string>
<key>OnDemand</key>
<false/>
<key>ProgramArguments</key>
<array>
<string>/Applications/Nikon Software/Wireless Transmitter Utility/NkPtpEnumWT3</string>
<string>-launchd</string>
</array>
</dict>
</plist>

I'm using this example because all Nikon software is currently incompatible with Catalina. Woo-hoo 32 bits!

The plists tell launchctl to launch programs. If you delete the plists, you then need to reboot the machine to stop the software that was launched. I recommend copying launchctl plists into a "OS_Upgrade_Maintenance" folder on the Desktop for reference and then trashing the ones you want to get rid of.

If you just delete folders like "ATT" in /Library/Application Support , launchctl is still going to try to launch that software via the LaunchAgent or LaunchDaemon plist. It's not a big problem, but it will probably fill your console logs with error messages that cause additional confusion later on.

If you're comfortable in the shell, you don't have to delete launchctl plists - you can stop the program and set the plist to not load it anymore at boot:

Launch Terminal and type:

sudo launchctl unload -w [path_to_plists_in_/Library/LaunchDaemons_folder]

<enter password when prompted>

or

launchctl unload -w [path_to_plists_in_LaunchAgents_and_home_folders]

ie:
sudo launchctl unload /Library/LaunchDaemons/NkPtpEnumWT3.plist

unload means quit, and -w means set the plist "disabled" key to True (so it won't launch again when you reboot)

 

[milleron]

@bry2k: That was a very interesting and informative post. I did look in all four of those folders. From the names of those .plist files, it's pretty easy to tell to which programs they pertain, and I'm sure there's nothing having to do with "ATT" or "AT&T."
But my Console does have a great many entries referencing this folder, one log entry every 10 seconds, for example:
Dec 12 00:33:16 MyName-iMac com.apple.xpc.launchd[1] (com.motive.mgmt-agent.system[3208]): Service could not initialize: Unable to set current working directory. error = 2: No such file or directory, path = /Library/Application Support/ATT/8.5.1.16: 19C57: xpcproxy + 14923 [673][DD0D92FC-A04C-38A0-BFAE-8494D610D4CB]: 0x2

When I search the Macintosh HD/Library for com.apple.xpc.launchd I am sent to two files, neither of them named that. They are "iMac.spx" and "system.txt." It seems obvious that neither of them have anything to do with this because the first is just a System Report, and the latter, a simple text file.

So I created a folder in Macintosh HD/Library/Application Support named "ATT" and an empty subfolder named "8.5.1.16." That stopped the endless logging cold.
But where else should I look to completely uninstall the now-useless program or service or script that initiates this process?