Numerous Mac users are repeatedly encountering a bug in macOS Ventura that throws up Login Items notifications for various background app processes every.

https://www.macrumors.com/2023/02/02/macos-background-items-added-notification-bug/

Check notification previews (but this does not stop the above popup): System Settings -> Notifications -> Show Previews

Seems like you cannot disable “System Settings -> General -> Login Items“

In Finder app, select Go -> Go to Folder… from the menu bar

Put the following address into the input field and press Enter: ~/Library/LaunchAgents and then (on my Mac the next does not exist) ~/Library/LaunchDaemons

For details read the above MacRumors article.

Apps for monitoring and managing background apps, agents, etc. (LaunchDaemons, LaunchAgents, Startup items)

In Terminal app execute the following command to get list of all items:

   sfltool dumpbtm

BlockBlock MacOS app (free): https://objective-see.org/products/blockblock.html

Malware installs itself persistently to ensure it’s automatically (re)executed.

BlockBlock monitors common persistence locations and alerts whenever a persistent component is added.

KnockKnock MacOS app: https://objective-see.org/products/knockknock.html

KnockKnock uncovers persistently installed software in order to generically reveal such malware.

How to Remove LaunchDaemons and LaunchAgents

The public /Library/LaunchAgents and /Library/LaunchDaemons folders are vulnerable to both legitimate and illegitimate apps. A legitimate app might use them for marketing, while malicious apps can use them to steal data and infect your Mac.

For adware and malware to be successful, they must persist in every user session. To do this, malware and adware authors create malicious code and put it in the LaunchAgent or LaunchDaemon folder. Every time your Mac starts, launchd will ensure that the malicious code runs automatically. Thankfully, security apps can help protect against this.

Apple Support article on how to “Manage login items and background tasks”

https://support.apple.com/guide/deployment/manage-login-items-background-tasks-mac-depdca572563/web

In macOS 13, a new structure in the app bundle simplifies the installation of login items and associated property lists (by updating helper executables from earlier versions of macOS). This framework is used to create transparency to the user when you configure LoginItems, LaunchAgents, and LaunchDaemons on a Mac. This framework uses the SMAppService object to control helper executables that live inside an app’s main bundle. It can also be used to register and control LoginItems, LaunchAgents, and LaunchDaemons as helper executables for an app and it works with all types of apps, regardless of how they were installed.

https://developer.apple.com/documentation/servicemanagement/updating_helper_executables_from_earlier_versions_of_macos

Launch daemons, launch agents, and startup items are helper executables that macOS starts on behalf of the user that extend the capabilities of apps or provide additional capabilities to users. For example:

• LaunchDaemon can provide persistent background service for an app
• LaunchAgent can provide auxiliary UI capabilities like menu bar extras
• LoginItem can provide the ability to automount remote directories or launch applications when the user logs in.

SMAppService (as of macOS 13)

https://developer.apple.com/documentation/servicemanagement/smappservice