Even when using integrity checksums, you have to be careful not to update them to match the malware, like brew did with Handbrake a while ago: https://github.com/caskroom/homebrew-cask/pull/33354