Pinned
XProtect catches what Apple already catalogued. Nick 4.5 correlates the sequence on-device: /tmp drop → unsigned exec → raw-IP outbound — quieter findings, stronger Apple trust checks.
Free. AGPL. Notarized DMG (not App Store — Endpoint Security + FDA can’t sandbox).

