ego-browser

No explicit backdoor/persistence/exfiltration logic is evident in this installer/launcher script itself. However, it creates a significant macOS supply-chain risk: it downloads and mounts a remote DMG (and possibly runs an included .pkg) without verifying integrity or authenticity, then removes com.apple.quarantine and performs privileged installation into /Applications before launching. If the CDN content (or transport path) were tampered with, this script would directly deliver and execute the attacker’s payload with elevated installation impact.