Nick 3.0

[EhsanAzish80]

Nick 3.0 — Release Notes

Release date: June 2, 2026
Build: 3.0 (1)
Minimum macOS: 26.0 (Tahoe)
Distribution: Direct (Developer ID, notarized)
Update feed: https://3nsofts.com/nick/appcast.xml

---

What's New in 3.0

Endpoint Security System Extension

Nick now ships with an Apple-approved Endpoint Security System Extension (NickExtension) — the same privileged kernel-level event pipeline used by enterprise EDR products. Rather than polling for changes after the fact, the extension intercepts AUTH_EXEC, AUTH_OPEN, AUTH_CREATE, AUTH_MMAP, and AUTH_COPYFILE events before they complete, allowing malicious files to be blocked before they execute.

The extension runs isolated from the main app, registered via SMAppService (modern API), and communicates back to the UI over a private XPC connection.

---

YARA Rule Engine

A full libyara 4.5.2 static engine is embedded directly in the ES scan pipeline. Every file that misses the hash cache is evaluated against a bundled community ruleset before an allow/deny decision is made.

Bundled rulesets:

• macos_adware.yar
• macos_backdoors.yar
• macos_ransomware.yar
• macos_stealers.yar

Features:

• Per-file scan timeout (10 seconds) — prevents stalls on large or malformed files
• YARA-only hits surfaced as YARA:<ruleName> in the threat log
• Graceful fallback if rules fail to compile at startup

---

Deep Scanner

A new on-demand Deep Scanner crawls the entire file system using the YARA engine, classifying matches into threat verdicts. The scan is battery-aware and skips paths that are already trusted. Progress is shown live in the Scan Progress view.

---

Real-Time Behavioral Correlation (15 rules)

A 15-rule ThreatCorrelator watches process genealogy and network behavior simultaneously and raises correlated alerts when suspicious chains are detected:

Rule	Signal
browser_to_shell	Browser spawns shell process
office_to_shell	Office app spawns shell process
pdf_to_shell	PDF viewer spawns shell process
app_to_downloader	App spawns curl/wget after execution
deep_shell_nesting	Shell chain depth ≥ 3
raw_ip_outbound	Process connects to bare IP (bypasses DNS)
+ 9 additional rules	Process injection, persistence, exfiltration patterns

---

LOLBin Detector

Detects abuse of legitimate macOS system binaries (curl, osascript, python3, bash, sh, perl, ruby, base64, etc.) when called from unusual parent processes or with suspicious arguments. Lives in ProcessMonitor/LOLBinDetector.swift.

---

Reverse Shell Detector

ReverseShellDetector inspects outbound network connections and cross-references them against the process tree to identify classic reverse shell patterns (shell process with stdin/stdout/stderr redirected to a socket).

---

AV/Capture Monitor (Camera & Microphone Surveillance Detection)

AVCaptureMonitor watches for processes accessing camera and microphone devices via AVCaptureDevice notifications. Detects unauthorized capture sessions and surfaces them as ThreatSignal alerts with the accessing process name and PID.

---

Persistence Watcher

PersistenceWatcher monitors all standard macOS persistence locations in real time:

• ~/Library/LaunchAgents/
• /Library/LaunchAgents/
• /Library/LaunchDaemons/
• Login Items (via AppleScript)
• Cron entries

New or modified entries that weren't present at baseline trigger an alert.

---

Network Inspector

NetworkInspector performs LAN host discovery and port scanning to identify vulnerable devices on the local network. Results are shown in the Network Inspector view with open port details per device.

---

USB / External Media Auto-Scan

When a removable volume is mounted, Nick automatically scans it using the YARA engine and signature database. Results appear in the USB Scan view. No user interaction required.

---

Performance Engine (30+ Cleanup Rules)

The built-in disk cleanup engine scans for recoverable disk space across 30+ categories:

Xcode artifacts (DerivedData, simulators, device support, documentation), browser caches (Chrome, Safari), app caches, iOS backups, old archives, large forgotten files, large duplicates, Python/Node/Gradle/SwiftPM caches, Adobe cache, Docker layers, Steam cache, meeting recordings, screen recording exports, Trash, logs, and more.

The engine is battery-aware and shows a live cleanup progress view with per-category size estimates before any deletion.

---

Privileged Helper (NickHelper)

A registered SMAppService privileged helper handles operations that require root without running the main app as root:

• SIP (System Integrity Protection) status reads
• Firewall state inspection
• Protected plist reads

Registered via modern SMAppService API (replaces legacy SMJobBless).

---

Finder Integration (NickFinderSync)

A Finder Sync Extension adds a right-click Scan with Nick context menu item to files and folders in Finder. Results are returned to the main app over XPC.

---

Signal Telemetry (Local, Privacy-Preserving)

SignalTelemetry records user verdicts (allow/block) on threat signals alongside the feature vectors that generated them. This data stays entirely on-device and is used to build training data for the local Core ML model. No data leaves the device.

---

Threat Log with Export

ThreatLogger stores all threat events in a SwiftData store with full metadata (original path, hash, threat name, severity, process chain, timestamp, resolution note). Logs can be exported as JSON, CSV, or key-value flat files from the Threat Log view.

---

System Audit & Security Score (Redesigned)

The System Audit view now shows a single 0–100 Security Score broken down across four components:

Component	Max Points
Real-Time Protection	37
Recent Threats	31
File Integrity	19
Privacy	13

Each row uses the same visual style as audit result rows — icon, title, description, and a direct "Fix" deep-link into System Settings where applicable.

---

Export Security Report

A new Export Report toolbar button in System Audit opens a save panel and writes a self-contained HTML report of the current audit snapshot — including the security score, all audit findings, and threat counts. No third-party dependencies.

---

Automatic Updates (Sparkle)

Nick uses Sparkle 2 to deliver automatic updates directly from https://3nsofts.com/nick/appcast.xml. Updates are:

• Delivered over HTTPS
• Verified with an EdDSA signature before installation
• Handled by Sparkle's sandboxed Downloader.xpc and Installer.xpc sub-processes (no elevated privileges required in the main app)
• Configurable from Settings → General → Updates

"Check for Updates…" is also available from the Nick menu at any time.

---

Changes from v1.2

Area	Change
Detection	ES System Extension replaces passive polling-based monitor
Detection	YARA engine added (v1.2 was hash-signature-only)
Detection	Behavioral correlation expanded from 8 → 15 rules
Detection	LOLBin detector added
Detection	Reverse shell detector added
Detection	AV/Capture monitor added
Detection	Persistence watcher added
Response	Deep Scanner added
Response	USB auto-scan added
UI	Report sidebar item removed — export is now a toolbar button in System Audit
UI	Security Score redesigned to match audit row style
UI	Signature Freshness component removed from health score (was showing stale data)
UI	Process Tree view rewritten (SecurityEngine-backed, removes old XPC-based implementation)
Reliability	UserDefaults.register(defaults:) called at launch — fixes notification spam on first run
Updates	Sparkle 2 integrated for automatic over-the-air updates
Platform	Minimum deployment target raised to macOS 26.0

---

Known Limitations

#	Area	Detail
1	Privileged Helper	getListeningPorts() returns an empty result (tracked: issue #43)
2	SwiftData	No versioned migration plan for ThreatLogEntry — avoid schema changes in point releases
3	Network Inspector	LAN scan and Scam Guardian (Phase 5) are monitoring-only in this release; blocking requires the Network Extension target (Phase 5)
4	ML Predictor	BehavioralScorer collects feature vectors but the Core ML inference model is not yet wired for live scoring (Phase 4 work)
5	System Settings links	Some deep-links in System Audit use the x-apple.preference.security scheme — verify each opens the correct pane on macOS 26

---

Upgrade Path

This is a major version with a new System Extension. On first launch after upgrade:

1. Nick will prompt to install the new NickExtension system extension
2. macOS will show a System Settings prompt to allow it — this requires user approval
3. The old polling-based monitors are automatically replaced once the extension is active

A clean install is recommended for the best experience.

---

Installation

Download Nick-v3.0.dmg
Open the DMG and drag Nick to Applications
Launch Nick from Applications
Verification

codesign -dv --verbose=4 /Applications/Nick.app 2>&1 | grep Authority
spctl -a -vv /Applications/Nick.app
shasum -a 256 Nick-v3.0.dmg
Expected: 498727c89fb5d065f68342d4370fa84de9b8f167d3a377c2ce66a4d11ecb22b
Security

Report vulnerabilities via GitHub Security Advisories or security@3nsofts.com.
See SECURITY.md for our disclosure policy.

License

AGPL-3.0

Full Changelog: v1.2...V3.0

---

This discussion was created from the release Nick 3.0.