Repolode
Submit
MotherSphere

MotherSphere/NIKKE-Launcher-Check

Read-only Rust scanner that checks Windows, Linux and macOS machines for traces of the November 2026 NIKKE PC launcher compromise.

View on GitHubWebsite
Stars
94
Forks
3
Open issues
3
Last commit
2 days ago

What is it?

NIKKE Launcher Check (nikke-check) looks for traces of the November 2026 compromise of the NIKKE PC launcher: the script loaded from insightjs.com, the remote-access agent that script downloaded, and the DLL and registry key the agent adds on Windows so that Google Chrome loads it. It only reads files, changes nothing, and makes no network connections. The only file it writes is a report the user saves manually. It also checks whether the hosts file blocks the malicious domains, without editing that file.

The tool runs on Windows, on Linux including Steam Deck through Proton, Lutris, Heroic, Bottles and Faugus, and on macOS for NIKKE running under Wine-based tools such as CrossOver, Whisky and Wineskin. It offers a quick scan of common install paths, a full scan of all local drives, and a scan of a chosen folder, with a GUI and a --cli mode.

Results fall into four verdicts: No traces found, Exposed, Infected, and NIKKE not found. Each result comes with guidance on which cleanup steps apply, and a report can be saved or copied with personal details redacted.

Key features

  • 01Read-only scan that never modifies, moves or deletes files
  • 02Makes no network connections and writes only a report the user saves
  • 03Checks Windows, Linux (including Steam Deck and Proton) and macOS under Wine
  • 04Quick, full and single-folder scan modes
  • 05Optional redaction of personal details in saved or copied reports
  • 06Command-line mode with documented exit codes

Use cases

  • Checking a Windows PC that ran the NIKKE launcher in late 2026
  • Checking a Steam Deck or Linux machine running NIKKE through Proton
  • Checking a Mac that runs NIKKE through CrossOver, Whisky or Wineskin
  • Producing a shareable report with personal details removed

Quick start

  1. 1

    Download the file for your system from the latest release

  2. 2

    Windows: double-click the .exe (if SmartScreen warns, click More info, then Run anyway)

  3. 3

    Linux and Steam Deck: make the file executable and run it

    cd ~/Downloads && chmod +x nikke-check-linux-x86_64 && ./nikke-check-linux-x86_64
  4. 4

    macOS on Apple silicon: remove the quarantine flag, make the file executable and run it

    cd ~/Downloads && chmod +x nikke-check-macos-arm64 && xattr -d com.apple.quarantine nikke-check-macos-arm64 && ./nikke-check-macos-arm64

Things to know

  • The Windows and macOS builds are unsigned, so the operating system will show a security warning.
  • It only checks for traces of the November 2026 NIKKE launcher compromise, not other malware.
  • Finding no traces does not prove that the computer is clean.

In collections

Security scanners, audits & threat intel tools

Topics

#security#incident-response#indicators-of-compromise#malware-detection#steam-deck#proton#wine#rust#iced#infostealer

FAQ

What is NIKKE-Launcher-Check?
Read-only Rust scanner that checks Windows, Linux and macOS machines for traces of the November 2026 NIKKE PC launcher compromise. NIKKE Launcher Check (nikke-check) looks for traces of the November 2026 compromise of the NIKKE PC launcher: the script loaded from insightjs.com, the remote-access agent that script downloaded, and the DLL and registry key the agent adds on Windows so that Google Chrome loads it. It only reads files, changes nothing, and makes no network connections. The only file it writes is a report the user saves manually. It also checks whether the hosts file blocks the malicious domains, without editing that file.
Is NIKKE-Launcher-Check free to use? What license does it have?
NIKKE-Launcher-Check is open source under the GPL-3.0 license. Check the license terms before using it in commercial products.
Is NIKKE-Launcher-Check still maintained?
Actively maintained. The last commit to NIKKE-Launcher-Check was on Nov 5, 2026.
What can I use NIKKE-Launcher-Check for?
Checking a Windows PC that ran the NIKKE launcher in late 2026 Checking a Steam Deck or Linux machine running NIKKE through Proton Checking a Mac that runs NIKKE through CrossOver, Whisky or Wineskin Producing a shareable report with personal details removed
How do I install NIKKE-Launcher-Check?
Download the file for your system from the latest release Windows: double-click the .exe (if SmartScreen warns, click More info, then Run anyway) Linux and Steam Deck: make the file executable and run it: cd ~/Downloads && chmod +x nikke-check-linux-x86_64 && ./nikke-check-linux-x86_64 macOS on Apple silicon: remove the quarantine flag, make the file executable and run it: cd ~/Downloads && chmod +x nikke-check-macos-arm64 && xattr -d com.apple.quarantine nikke-check-macos-arm64 && ./nikke-check-macos-arm64
Where can I get NIKKE-Launcher-Check?
The source code and installation instructions are on GitHub: https://github.com/MotherSphere/NIKKE-Launcher-Check

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects

Cisco-Talos / clamav

Open source antivirus engine for detecting trojans, viruses, malware and other malicious threats.

Security#antivirus#malware-detection#security
7.5K+37 this week956CGPL-2.0Updated 21 hours ago