Yes, this applies to Linux as well according to the Github page.

Check if you are infected

1. Open your NIKKE install folder.
2. Open Launcher/intl_service/debug.log in a text editor.
3. Search for k2f_chan.

What to do

1. Do not open the NIKKE PC launcher until Level Infinite confirms the fix.
2. Before you open it again, delete the launcher's cache folder %APPDATA%\nikke_launcher\tbs_cache (inside your prefix on Proton). It may still hold the modified files from before the fix.
3. Block these in your hosts file, router or firewall:

insightjs.com
analytics.insightjs.com
insightjs.org
89.127.233.127

This only stops the current server. How the attacker got write access to Level Infinite's CDN is not known yet, so they may be able to try again with a new domain.

If you are infected

1. Close the launcher, or disconnect from the internet, so the attacker loses access.
2. On Windows, remove the persistence:

• First delete HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04} if it exists. The same CLSID also exists under HKLM on every Windows install, pointing to wpc.dll (WindowsParentalControls). Leave that one. Only the HKCU copy is malicious.
• Restart Windows. The DLL stays locked while it is loaded, even with every Chrome window closed (reported).
• Then open %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\ and delete any subfolder whose name is a 64-character hex string and that holds platform_experience_helper.dll. Do not delete the whole folder: Chrome creates PlatformExperienceHelper itself for its own platform_experience_helper.exe and an empty LoadFeatures file, so the folder on its own is normal.
• Microsoft Defender Offline did not detect the DLL on one machine (signatures 1.463.110.0), so a clean antivirus scan does not mean it is gone.
• Reinstalling Windows is the safest option, because the attacker could run any command while the agent was active.

3. From a clean device, change your passwords: NIKKE / Level Infinite first, then email, Discord, banking and every password saved in a browser. Turn on two-factor authentication.
4. Log out of all sessions (Discord, Google, Steam, GitHub and others). The agent can steal browser cookies, which work without your password.
5. Revoke and regenerate API tokens, SSH keys and any developer credentials (GitHub, npm, AWS, OpenAI, Anthropic and others).
6. Move crypto wallet funds to a new wallet with a new seed phrase.