Releases: EhsanAzish80/Nick
Release list
Nick 4.0
EhsanAzish80
Ehsan Azish
704e4fa
EhsanAzish80
Ehsan Azish
Nick 4.0 is the current stable release for macOS 26 and later.
This release adds the production Endpoint Security and Network Extension architecture, guided protection setup, active Scam Guardian filtering, improved Email Guard coverage, clearer actionable alerts, performance improvements, and a complete native uninstaller.
Installation:
- Download and open
Nick-4.0-build-404.dmg. - Run the signed Nick installer package.
- Follow Nick's guided setup and approve the requested macOS protections.
- Restart the Mac if macOS requests it, then return to Nick to verify every Smart Scan protection.
The DMG is signed, notarized, and stapled. Its SHA-256 checksum is:
8750a55f764f5ed105a4387e64c26d45f66de005feca1f8fd212d7cdd6fef5fc Nick-4.0-build-404.dmg
See CHANGELOG.md for release details and SECURITY.md for security reporting.
Nick 3.0
Nick 3.0 — Release Notes
Release date: June 2, 2026
Build: 3.0 (1)
Minimum macOS: 26.0 (Tahoe)
Distribution: Direct (Developer ID, notarized)
Update feed: https://3nsofts.com/nick/appcast.xml
What's New in 3.0
Endpoint Security System Extension
Nick now ships with an Apple-approved Endpoint Security System Extension (NickExtension) — the same privileged kernel-level event pipeline used by enterprise EDR products. Rather than polling for changes after the fact, the extension intercepts AUTH_EXEC, AUTH_OPEN, AUTH_CREATE, AUTH_MMAP, and AUTH_COPYFILE events before they complete, allowing malicious files to be blocked before they execute.
The extension runs isolated from the main app, registered via SMAppService (modern API), and communicates back to the UI over a private XPC connection.
YARA Rule Engine
A full libyara 4.5.2 static engine is embedded directly in the ES scan pipeline. Every file that misses the hash cache is evaluated against a bundled community ruleset before an allow/deny decision is made.
Bundled rulesets:
macos_adware.yarmacos_backdoors.yarmacos_ransomware.yarmacos_stealers.yar
Features:
- Per-file scan timeout (10 seconds) — prevents stalls on large or malformed files
- YARA-only hits surfaced as
YARA:<ruleName>in the threat log - Graceful fallback if rules fail to compile at startup
Deep Scanner
A new on-demand Deep Scanner crawls the entire file system using the YARA engine, classifying matches into threat verdicts. The scan is battery-aware and skips paths that are already trusted. Progress is shown live in the Scan Progress view.
Real-Time Behavioral Correlation (15 rules)
A 15-rule ThreatCorrelator watches process genealogy and network behavior simultaneously and raises correlated alerts when suspicious chains are detected:
| Rule | Signal |
|---|---|
browser_to_shell |
Browser spawns shell process |
office_to_shell |
Office app spawns shell process |
pdf_to_shell |
PDF viewer spawns shell process |
app_to_downloader |
App spawns curl/wget after execution |
deep_shell_nesting |
Shell chain depth ≥ 3 |
raw_ip_outbound |
Process connects to bare IP (bypasses DNS) |
| + 9 additional rules | Process injection, persistence, exfiltration patterns |
LOLBin Detector
Detects abuse of legitimate macOS system binaries (curl, osascript, python3, bash, sh, perl, ruby, base64, etc.) when called from unusual parent processes or with suspicious arguments. Lives in ProcessMonitor/LOLBinDetector.swift.
Reverse Shell Detector
ReverseShellDetector inspects outbound network connections and cross-references them against the process tree to identify classic reverse shell patterns (shell process with stdin/stdout/stderr redirected to a socket).
AV/Capture Monitor (Camera & Microphone Surveillance Detection)
AVCaptureMonitor watches for processes accessing camera and microphone devices via AVCaptureDevice notifications. Detects unauthorized capture sessions and surfaces them as ThreatSignal alerts with the accessing process name and PID.
Persistence Watcher
PersistenceWatcher monitors all standard macOS persistence locations in real time:
~/Library/LaunchAgents//Library/LaunchAgents//Library/LaunchDaemons/- Login Items (via AppleScript)
- Cron entries
New or modified entries that weren't present at baseline trigger an alert.
Network Inspector
NetworkInspector performs LAN host discovery and port scanning to identify vulnerable devices on the local network. Results are shown in the Network Inspector view with open port details per device.
USB / External Media Auto-Scan
When a removable volume is mounted, Nick automatically scans it using the YARA engine and signature database. Results appear in the USB Scan view. No user interaction required.
Performance Engine (30+ Cleanup Rules)
The built-in disk cleanup engine scans for recoverable disk space across 30+ categories:
Xcode artifacts (DerivedData, simulators, device support, documentation), browser caches (Chrome, Safari), app caches, iOS backups, old archives, large forgotten files, large duplicates, Python/Node/Gradle/SwiftPM caches, Adobe cache, Docker layers, Steam cache, meeting recordings, screen recording exports, Trash, logs, and more.
The engine is battery-aware and shows a live cleanup progress view with per-category size estimates before any deletion.
Privileged Helper (NickHelper)
A registered SMAppService privileged helper handles operations that require root without running the main app as root:
- SIP (System Integrity Protection) status reads
- Firewall state inspection
- Protected plist reads
Registered via modern SMAppService API (replaces legacy SMJobBless).
Finder Integration (NickFinderSync)
A Finder Sync Extension adds a right-click Scan with Nick context menu item to files and folders in Finder. Results are returned to the main app over XPC.
Signal Telemetry (Local, Privacy-Preserving)
SignalTelemetry records user verdicts (allow/block) on threat signals alongside the feature vectors that generated them. This data stays entirely on-device and is used to build training data for the local Core ML model. No data leaves the device.
Threat Log with Export
ThreatLogger stores all threat events in a SwiftData store with full metadata (original path, hash, threat name, severity, process chain, timestamp, resolution note). Logs can be exported as JSON, CSV, or key-value flat files from the Threat Log view.
System Audit & Security Score (Redesigned)
The System Audit view now shows a single 0–100 Security Score broken down across four components:
| Component | Max Points |
|---|---|
| Real-Time Protection | 37 |
| Recent Threats | 31 |
| File Integrity | 19 |
| Privacy | 13 |
Each row uses the same visual style as audit result rows — icon, title, description, and a direct "Fix" deep-link into System Settings where applicable.
Export Security Report
A new Export Report toolbar button in System Audit opens a save panel and writes a self-contained HTML report of the current audit snapshot — including the security score, all audit findings, and threat counts. No third-party dependencies.
Automatic Updates (Sparkle)
Nick uses Sparkle 2 to deliver automatic updates directly from https://3nsofts.com/nick/appcast.xml. Updates are:
- Delivered over HTTPS
- Verified with an EdDSA signature before installation
- Handled by Sparkle's sandboxed
Downloader.xpcandInstaller.xpcsub-processes (no elevated privileges required in the main app) - Configurable from Settings → General → Updates
"Check for Updates…" is also available from the Nick menu at any time.
Changes from v1.2
| Area | Change |
|---|---|
| Detection | ES System Extension replaces passive polling-based monitor |
| Detection | YARA engine added (v1.2 was hash-signature-only) |
| Detection | Behavioral correlation expanded from 8 → 15 rules |
| Detection | LOLBin detector added |
| Detection | Reverse shell detector added |
| Detection | AV/Capture monitor added |
| Detection | Persistence watcher added |
| Response | Deep Scanner added |
| Response | USB auto-scan added |
| UI | Report sidebar item removed — export is now a toolbar button in System Audit |
| UI | Security Score redesigned to match audit row style |
| UI | Signature Freshness component removed from health score (was showing stale data) |
| UI | Process Tree view rewritten (SecurityEngine-backed, removes old XPC-based implementation) |
| Reliability | UserDefaults.register(defaults:) called at launch — fixes notification spam on first run |
| Updates | Sparkle 2 integrated for automatic over-the-air updates |
| Platform | Minimum deployment target raised to macOS 26.0 |
Known Limitations
| # | Area | Detail |
|---|---|---|
| 1 | Privileged Helper | getListeningPorts() returns an empty result (tracked: issue #43) |
| 2 | SwiftData | No versioned migration plan for ThreatLogEntry — avoid schema changes in point releases |
| 3 | Network Inspector | LAN scan and Scam Guardian (Phase 5) are monitoring-only in this release; blocking requires the Network Extension target (Phase 5) |
| 4 | ML Predictor | BehavioralScorer collects feature vectors but the Core ML inference model is not yet wired for live scoring (Phase 4 work) |
| 5 | System Settings links | Some deep-links in System Audit use the x-apple.preference.security scheme — verify each opens the correct pane on macOS 26 |
Upgrade Path
This is a major version with a new System Extension. On first launch after upgrade:
- Nick will prompt to install the new
NickExtensionsystem extension - macOS will show a System Settings prompt to allow it — this requires user approval
- The old polling-based monitors are automatically replaced once the extension is active
A clean install is recommended for the best experience.
Installation
Download Nick-v3.0.dmg
Open the DMG and drag Nick to Applications
Launch Nick from Applications
Verification
codesign -dv --verbose=4 /Applications/Nick.app 2>&1 | grep Authority
spctl -a -vv /Applications/Nick.app
shasum -a 256 Nick-v3.0.dmg
Expected: 498727c89fb5d065f68342d4370fa84de9b8f167d3a377c2ce66a4d11ecb22b
Security
Report vulnerabilities via GitHub Security Advisories or security@3nsofts.com.
See SECURITY.md for our disclosure policy.
License
AGPL-3.0
Full Changelog: https://github.com/EhsanAzish8...
Nick v1.2 — AI & Reporting
Nick v1.2 — AI & Reporting
One app. Six detection layers. On-device AI threat scoring. Zero cloud dependency.
New: Logging & SIEM Integration
Nick now ships a functional logging pipeline. Pick your format, pick your output, done.
- Formats: Key=Value · JSON · CEF
- Outputs: Local log file (
~/Library/Logs/Nick/nick-YYYY-MM-DD.log, daily rotation, 30-day retention) · HTTP POST webhook (Splunk HEC, AWS, PagerDuty, any HTTPS endpoint) · stdout - MDM-configurable — all logging settings readable from the managed defaults domain
com.ehsanazish.nick - No syslog. No OpenTelemetry. No dedicated developer required.
New: Detection Additions
- Finder Sync Extension — "Scan with Nick" appears automatically in Finder right-click menu, no user configuration needed
- Scheduled Deep Scan — daily, weekly, or monthly full-system YARA scan (configurable in Settings)
getListeningPortsimplemented viasysctl— closes #43proc_pidfdinforeplaceslsoffor network scanning — closes #1- Network baseline anomaly detection — flags processes whose connection patterns change unexpectedly
New: Enterprise Foundation
- MDM configuration profile support — all settings configurable via managed
com.ehsanazish.nickdefaults domain. Seedocs/MDM_CONFIGURATION.md - Configurable alert suppression rules — suppress by process name, file path, or correlation rule name
AI Improvements
- Foundation Models explanations now on all alert paths (full scan + quickTick)
- Opt-in local signal telemetry for future CoreML model training
UI Improvements
- Follows system dark/light mode — user can override in Settings → Appearance
- Hero card with green tint background
- Score merged into hero card
- Status rows are interactive buttons with hover state
- HTTP endpoint field fixed (full width, LTR, URL validation, test alert button)
- Suppression Rules form redesigned
monitoringSincepersists correctly across restarts
Bug Fixes
- Fixed launchd (PID 1) failing signature validation
- Fixed ULA IPv6 (fd::/fc::) addresses triggering raw IP alerts
- Fixed Deep Scan YARA matches in signed app data generating alerts
- Fixed webhook URL field rendering as tappable link
- Fixed empty divider in Suppression Rules when list is empty
Requirements
- macOS 26 or later
- Apple Silicon or Intel Mac
Installation
- Download
Nick-v1.2.dmg - Open the DMG and drag Nick to Applications
- Launch Nick from Applications
Verification
codesign -dv --verbose=4 /Applications/Nick.app 2>&1 | grep Authority
spctl -a -vv /Applications/Nick.app
shasum -a 256 Nick-v1.2.dmg
# Expected: fee2f06dcafc4ce571d064584e3b149b791a988663bb65d204226c20d8616b08
Security
Report vulnerabilities via GitHub Security Advisories or security@3nsofts.com.
See SECURITY.md for our disclosure policy.
License
AGPL-3.0
Nick v1.1 — Detection Hardening & UI Overhaul
Nick v1.1 — Detection Hardening & UI Overhaul
Security Fixes
- Fixed supply-chain bypass in trust downgrade — persistence alerts are never
downgraded regardless of trusted process involvement - Replaced all path-based exclusions with signature-based verification — files
are only trusted if the parent app bundle is properly signed by Apple or a
known developer - Trusted process verification now checks code signature, not just process name —
prevents impersonation by renamed malicious binaries - Fixed raw IP outbound false positives — excluded 0.0.0.0, link-local (fe80::),
ULA (fd/fc), localhost, and private network ranges from alerting - Fixed launchd (PID 1) failing signature validation
New Features
- Main application window with sidebar navigation (replaces menu bar panel)
- Deep Scan — full-system YARA scan with progress tracking, verdict classification,
and export reports - Drag-and-drop file scanning in the Scan tab
- Persistence view with status filters (All/Verified/Missing/Broken) and right-click
context menu (Show in Finder, Copy Path, Remove) - Login Items monitoring via System Events
- Shell profile monitoring (~/.zshrc, ~/.bash_profile, /etc/zshrc)
- SSH authorized_keys monitoring
- System hardening alerts for firewall, stealth mode, remote login, and XProtect
- Foundation Models threat explanations on all alerts (macOS 26+)
- Onboarding welcome screen with permission guidance
- Firewall allowed apps audit — flags stale, unsigned, or non-standard entries
- Notification "View in Nick" action
- Audit deep links to System Settings
- "Scan with Nick" Finder Services integration
Improvements
- Scan progress overlay with per-stage tracking
- Overview dashboard with security gauge, sparkline charts, protection summary,
and recent activity feed - Settings window redesigned with grouped sections
- Alert cards show file path, PID, Kill Process, and Show in Finder actions
- Deep Scan verdict classification: Threats, Suspicious, Application Data,
Development Artifacts - Window hides on close (red button) instead of quitting — menu bar icon reopens
- SwiftData schema versioning for future migrations
- UserDefaults registered with sensible defaults
- SonarCloud and Codecov integration
Bug Fixes
- Fixed scan blocking main thread (actor refactor)
- Fixed ProcNetHelper port overflow for ports ≥ 32768
- Fixed ProcNetHelper bindMemory alignment crash
- Fixed notification permission never being requested
- Fixed "Checking..." stuck state in process signature column
- Fixed empty function SonarCloud warnings
- Removed dead DashboardView code from menu bar panel era
- Zero compiler warnings
Requirements
- macOS 26 or later
- Apple Silicon or Intel Mac
Verification
codesign -dv --verbose=4 /Applications/Nick.app 2>&1 | grep Authority
spctl -a -vv /Applications/Nick.app
shasum -a 256 Nick-v1.1.dmg
Expected: f532a5fd8d8733df5d19477e204071679838a944575331b9761744b462180616
Security
Report vulnerabilities via GitHub Security Advisories
or security@3nsofts.com.
Nick v1.0 — Open-Source macOS Security Suite
Nick v1.0 — Open-Source macOS Security Suite
One app. Six detection layers. On-device AI threat scoring. Zero cloud dependency.
What's included
- System integrity audit (SIP, FileVault, Gatekeeper, Firewall, XProtect)
- Real-time process monitoring with LOLBin and parent-chain detection
- Network connection analysis with reverse shell detection
- Persistence monitoring (LaunchAgents, LaunchDaemons, Login Items, shell profiles, SSH keys)
- YARA scanning with curated macOS rule sets (Deep Scan + real-time FSEvents)
- On-device Foundation Models threat explanations (macOS 26+)
- Camera and microphone access monitoring
- 269 tests, 0 failures
Requirements
- macOS 26 or later
- Apple Silicon or Intel Mac
Installation
- Download
Nick-v1.0.dmg - Open the DMG and drag Nick to Applications
- Launch Nick from Applications
- Grant notification permission when prompted
- Optionally grant Full Disk Access in System Settings → Privacy & Security for comprehensive monitoring
Verification
# Verify code signature
codesign -dv --verbose=4 /Applications/Nick.app 2>&1 | grep Authority
# Verify notarization
spctl -a -vv /Applications/Nick.app
# Verify DMG checksum
shasum -a 256 Nick-v1.0.dmg
# Expected: 6a955d851b98315831d3efbd9f9b27b1b24846b660fd07b737e5a3c60f8acb64
Security
Report vulnerabilities via GitHub Security Advisories or security@3nsofts.com.
See SECURITY.md for our disclosure policy.
License
AGPL-3.0