Bad things come in large packages: .pkg signature verification bypass on macOS
sector7.computest.nl