Desktop Insights reads thousands of macOS applications to record the SDKs, frameworks and libraries they bundle. The obvious question is which tool does that. The more useful one is where the information lives, because an Electron app and a native app keep it in different places, and one of them barely keeps it at all.
Electron apps hand you the metadata
An Electron app ships a full Chromium runtime and a Node environment, and that architecture leaves a paper trail.
package.json
Every Electron app carries a package.json listing its npm dependencies. We read it from the app's resources/ directory or from inside the .asar archive. That gives us the dependency tree: framework versions, utility libraries, and everything in between.
CREDITS.html
Chromium bundles a CREDITS.html listing every open-source component compiled into the browser engine. We parse it to identify which Chromium version the app ships and which upstream libraries it includes: ICU, V8, Skia and the rest.
The asar archive
Electron apps usually bundle their application code in an .asar archive, a tar-like format. We unpack it and inspect the contents for bundled modules, configuration files, and any dependency manifests that package.json does not fully capture.
Native apps make you read the binary
A native macOS app has no package.json. We infer its dependencies from what the bundle carries.
Framework plists
macOS frameworks include Info.plist files with version numbers and bundle identifiers. We scan every .framework directory inside the app bundle and read those files to identify frameworks such as Sparkle, Sentry and Realm.
CocoaPods and SPM bundles
Apps built with CocoaPods or Swift Package Manager often include resource bundles with identifying metadata. We look for .bundle directories and their plists to detect pod and package dependencies.
Strings in the binary
When the bundle carries no manifest, we run strings on the executable and look for known SDK signatures: version strings, class-name prefixes, and API endpoint patterns that identify a specific SDK. This is how we detect analytics providers like Amplitude, crash reporters like Bugsnag, and feature-flag services like LaunchDarkly.
Every extraction becomes a dated snapshot
Each extraction produces a structured record: app name, version, the dependencies with their versions, and the frameworks bundled inside. We keep those records over time, so you can see when an app added Sentry, upgraded Electron, or dropped a legacy framework.
The result is a version-by-version history of each tracked app's stack. Most of these apps are closed source, so for them the shipped binary is the only place that history exists.