Native, local-first protection that explains what happened, why it matters, and what to do next.
Download Nick · Website · Documentation · Support
Nick is an open-source macOS security application built to make advanced protection understandable. It combines Apple's Endpoint Security and Network Extension frameworks with YARA malware scanning, behavioral correlation, system-hardening checks, email attachment inspection, quarantine, and human-readable alerts.
Detection and analysis run locally on the Mac. Nick does not upload browsing history, file contents, process activity, or security telemetry to a hosted analysis service.
Unlike a simple scanner, Nick continuously connects evidence from processes, files, persistence, privacy access, and network activity. A single unusual event can be explained without automatically being called malware; stronger, correlated evidence can be blocked, quarantined, and presented with a clear next action.
| Layer | What it does |
|---|---|
| Real-Time Protection | Observes process and file activity through Apple's Endpoint Security framework. |
| Malware Scanner | Uses YARA rules for on-demand, real-time, email, and external-volume scanning. |
| Behavioral Detection | Correlates process, persistence, filesystem, privacy, and network signals. |
| Scam Guardian | Optionally blocks known phishing and lookalike destinations with a Network Extension. |
| Email Guard | Scans supported Apple Mail and Outlook attachment locations. |
| Ransomware Shield | Watches sentinel files and suspicious high-volume file changes. |
| System Audit | Checks SIP, FileVault, Gatekeeper, firewall, updates, XProtect, and persistence. |
| Threat Timeline | Keeps a bounded, searchable record of relevant security activity. |
| Quarantine | Re-verifies and isolates actionable files while preserving recovery information. |
| Performance | Explains disk usage and offers reviewed, opt-in cleanup actions. |
The NickExtension system extension uses Apple's Endpoint Security framework
to observe file and process activity. It performs YARA and behavioral checks,
reports activity to the main app, and can deny a confirmed malicious file
before execution.
- Vendored libyara 4.5.5 with curated macOS rules.
- On-demand, real-time, email attachment, and external-volume scanning.
- Confidence-aware results: heuristic matches are shown for review; only actionable matches can be blocked or quarantined.
- Quarantine re-scans the selected file before moving it.
- Alerts show the file name, path, matching rule, source, recommended action, and relevant controls.
Nick correlates process, persistence, network, file, and privacy signals rather than treating every unusual event as malware. Coverage includes suspicious parent-child chains, living-off-the-land tools, reverse-shell patterns, unsigned executables in writable locations, persistence changes, and unexpected camera or microphone activity.
The optional NickNetFilter system extension uses Apple's Network Extension
content-filter APIs to evaluate connection destinations against signed rules
and lookalike-domain checks. It does not inspect page contents or store full
URLs, query strings, or payloads. Allowlisted apps and domains take precedence,
and the filter fails open when its configuration cannot be read.
Email Guard monitors supported Apple Mail and Outlook attachment locations through the Endpoint Security extension. New attachments are scanned before Nick reports them as safe. Full Disk Access is required for protected mail data.
- SIP, FileVault, Gatekeeper, firewall, XProtect, and update checks.
- LaunchAgent, LaunchDaemon, login-item, cron, and other persistence checks.
- Process and active-connection views with human-readable context.
- File-integrity and ransomware sentinel monitoring.
- Privacy permission and capture-device change monitoring.
- Bounded Threat Timeline and exportable security reports.
- Disk-usage analysis and reviewed cleanup recommendations.
- Background work uses reduced cadence when Nick is not active.
- Bounded caches, event stores, and scan concurrency.
- A bundled native uninstaller removes Nick, its protection components, generated data, settings, and installed applications.
- Local by default. Detection and correlation happen on the Mac.
- Evidence before alarm. Unusual behavior is explained without pretending that every anomaly is malware.
- Actionable alerts. Alerts identify the relevant file, process, rule, source, recommended response, and available controls.
- Verified protection. Installation alone is never shown as a healthy protection state; components must report current runtime health.
- User-controlled remediation. Cleanup, quarantine, permissions, and optional network filtering remain visible decisions.
Nick ships as a signed application bundle containing two system extensions:
Nick.app
├── SwiftUI application
│ ├── SecurityEngine and MonitorCoordinator
│ ├── Smart Scan, Alerts, Timeline, Quarantine, and Reports
│ └── Setup, settings, Sparkle updates, and maintenance
├── NickExtension.systemextension
│ ├── Endpoint Security client
│ ├── YARA and behavioral scanning
│ ├── Email Guard, ransomware, integrity, and privacy monitors
│ └── authenticated XPC service
└── NickNetFilter.systemextension
├── Network Extension content filter
├── Scam Guardian and signed blocklist policy
└── privacy-safe health and block events
Nick Uninstaller.app
└── guided removal and cleanup
The main architectural rule is that installation is not treated as proof of protection. Smart Scan and setup show a green state only after the relevant component reports current health.
For implementation details and trust boundaries, see ARCHITECTURE.md.
- macOS 26 or later.
- Xcode 26 or later for source builds.
- A Mac capable of running macOS 26.
- Apple-approved Endpoint Security and Network Extension entitlements for signed system-extension builds.
The current stable release is Nick 4.0 (build 404) for macOS 26 and later.
- Download the notarized Nick disk image from the latest GitHub release.
- Open the disk image and run the signed installer package.
- Launch Nick from
/Applications. - Follow the setup walkthrough. macOS requires explicit user approval for system extensions, Network Extensions, and Full Disk Access.
- Complete Smart Scan and confirm that each enabled protection reports current health.
The disk image is a presentation wrapper around the installer package. Sparkle updates use the signed package directly.
| Approval | Used by | Purpose |
|---|---|---|
| Endpoint Security system extension | NickExtension | Real-time process and file monitoring |
| Network Extension | NickNetFilter | Optional Scam Guardian destination filtering |
| Full Disk Access | Nick and NickExtension | Protected system and mail attachment locations |
| Notifications | Nick | User-facing threat notifications |
Nick cannot silently grant these approvals. The setup walkthrough opens the correct macOS pane and waits for verified component health.
Clone and open the checked-in Xcode project:
git clone https://github.com/EhsanAzish80/Nick.git
cd Nick
open Nick.xcodeprojBuild without signing:
xcodebuild build \
-project Nick.xcodeproj \
-scheme Nick \
-destination "platform=macOS" \
CODE_SIGN_IDENTITY="" \
CODE_SIGNING_REQUIRED=NO \
CODE_SIGNING_ALLOWED=NORun the complete test suite with coverage:
xcodebuild test \
-project Nick.xcodeproj \
-scheme Nick \
-destination "platform=macOS" \
-enableCodeCoverage YES \
-resultBundlePath TestResults.xcresult \
CODE_SIGN_IDENTITY="" \
CODE_SIGNING_REQUIRED=NO \
CODE_SIGNING_ALLOWED=NOUnsigned builds are compile and unit-test evidence only. They cannot prove that Endpoint Security or Network Extension installation works.
The production release pipeline is documented in Packaging/README.md. In summary:
Packaging/release.shbuilds, signs, notarizes, staples, and validates the installer package.Packaging/build-dmg.shcreates the notarized manual-download disk image.- Sparkle reads
https://3nsofts.com/nick/appcast.xml. - The appcast enclosure must reference the exact, unmodified signed package.
- Manual website and GitHub downloads may use the disk image.
Version 4.0 release notes are in Packaging/Release/v4.0.0/RELEASE_NOTES.md.
GitHub Actions builds all shipping targets, runs the test suite with coverage,
uploads the Xcode result bundle to Codecov, and, when SONAR_TOKEN is
configured, converts Xcode coverage and runs CI-based SonarCloud analysis.
Project coverage measures production targets only; test-source targets are excluded so executing the tests cannot inflate the headline percentage. The current project target is a 15% honest baseline. Patch coverage is reported as an informational signal while coverage expands around legacy UI and platform-integration code.
Repository settings required for hosted analysis:
CODECOV_TOKENrepository secret.SONAR_TOKENrepository secret.- SonarCloud Automatic Analysis disabled so CI-based coverage is used.
Vendored libyara sources and generated build, package, and result artifacts are excluded from SonarCloud ownership and coverage calculations.
Run /Applications/Nick Uninstaller.app. The uninstaller guides removal of
active protection, application data, preferences, installed components, and
both application bundles. macOS can retain a disabled privacy-list row after
the executable is removed; that row is system-owned UI state and does not mean
the extension remains installed.
- Documentation index
- Changelog
- Architecture and security boundaries
- User and operator guide
- Development and CI guide
- Release checklist
- Roadmap
- Contributing
- Support
- Security policy
- Security audit record
Nick 4.0 is the current production release. Every future release remains gated on clean-Mac validation of Endpoint Security, Email Guard, Scam Guardian, updates, performance, quarantine, and uninstall behavior.
Nick is licensed under the GNU Affero General Public License v3.0.
Nick uses YARA and builds on public macOS security research, including the work of the Objective-See Foundation and the wider macOS security community.