Thanks for the information, I hope Avast! detects this.
No OS is safe from software installation initiated and authorized by the user, the user only needs to be convinced to initiate the installation.
However, as a mitigating factor, by default, OS X only allows installation of apps downloaded from the Mac Apps Store (curated) or identified developers (which include Apple Developer issued certificate), this behaviour can be changed.