I don't think install_name has for purpose to prevent dylib hijacking. In fact there were DYLD_LIBRARY_PATH, DYLD_FALLBACK_LIBRARY_PATH, and other stuff that us

I don't think install_name has for purpose to prevent dylib hijacking. In fact there were DYLD_LIBRARY_PATH, DYLD_FALLBACK_LIBRARY_PATH, and other stuff that used to trivially† go around that (now disabled — IIRC — when SIP is active). The purpose of install_name and @executable_path is, to me, to leverage the concept of a bundle (may it be a .app or a .framework) to solve dependency hell issues and have self-contained, relocatable, forward- and backward-compatible software. † https://stackoverflow.com/a/41072072/368409 https://stackoverflow.com/a/41072072/368409