Nick

Nick is an open-source, privacy-first macOS security suite that correlates process, persistence, network, filesystem, and YARA signals into an on-device behavioral threat score.

Comment

Inspiration

macOS is secure. Until it isn't. XProtect, Gatekeeper, and SIP are signature-based and reactive. They catch threats Apple has catalogued — after the fact. They don't catch a signed app quietly exfiltrating your keychain, curl piping to bash, a LaunchAgent silently dropped by a compromised installer, or a reverse shell opened through ssh port forwarding. Existing tools either cost $60+/year, require installing 5–6 separate utilities with no unified view, or are enterprise-only. Nick is one app that replaces six tools, with the only open-source on-device AI behavioral threat scoring engine for macOS.

What it does

XProtect, Gatekeeper, and SIP are signature-based and reactive. They catch threats Apple has catalogued — after the fact. They don't catch a signed app quietly exfiltrating your keychain, curl piping to bash, a LaunchAgent silently dropped by a compromised installer, or a reverse shell opened through ssh port forwarding.

How we built it

Nick's ThreatCorrelator collects signals from all monitors within a 30-second sliding window and feeds a ~40-feature vector to a CoreML behavioral model. The model outputs a 0.0–1.0 threat probability. Scores above 0.8 trigger a high-priority notification with a Foundation Models–generated plain-English explanation.

Challenges we ran into

Full Disk Access. Network monitoring. Camera and microphone access.

Accomplishments that we're proud of

The v3.0 target is under 1% CPU and under 50 MB RAM in steady state. The Endpoint Security extension receives kernel events asynchronously — there is no polling loop. Other monitors use event-driven APIs (FSEvents, NWPathMonitor) wherever possible.

What we learned

Nick is a full antivirus. The Apple Endpoint Security system extension provides real-time kernel-level interception of file writes and process execution, and Nick ships with a live SHA-256 signature database that updates automatically via Sparkle. On top of that, behavioral correlation and YARA scanning catch threats that signature databases miss.

What's next for Nick

Full network monitoring and email guards and sytsem wide threat ditections in background

Built With

  • swiftui
Share this project:

Updates