The Apple Mac OS 10.6 + detects the few malwares downloaded from internet as per the signatures found in XProtect.plist file. This is not an antivirus application and only alerts the user when he tries download/install the suspicious application from internet. This file is located at /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist. You will need a good security software to protect your mac from bad guys on internet. you can read more on this here and here
Code signing is a macOS security technology that you use to certify that an app was created by you. Once an app is signed, the system can detect any change to the app—whether the change is introduced accidentally or by malicious code. As Apple Developer site says ( click here for more details on code signing) : code signing allows the operating system to: Ensure that a piece of code has not been altered since it was signed. The system can detect even the smallest change, whether it was intentional (by a malicious attacker, for example) or accidental (as when a file gets corrupted). When a code signature is intact, the system can be sure the code is as the signer intended. Identify code as coming from a specific source (a developer or signer). The code signature includes cryptographic information that unambiguously points to a particular author. Determine whether code is trustworthy for a specific purpose. Among other things, a developer can use a ...