I just opened a disk image from a source that I don't trust very much now. I only ran the program from the dmg mounted in the finder. Now- could any trojan or keylogger be installed if I simply ran the program from the mounted disk image, or am I just being paranoid?