Bad things come in large packages: .pkg signature verification bypass on macOS | Dark Hacker News