<p>Suspicious Package is an indispensable tool for macOS with a long history, and surprisingly, it’s free. I’ve rarely mentioned it, so I thought I’d give it a quick review.</p>
<p><a href="https://www.mothersruin.com/software/SuspiciousPackage/">Suspicious Package</a> has been around for as long as I can remember. It’s been steadily updated over the years, and runs perfectly on the latest macOS (Sequoia). It makes inscrutable Package Installers scrutable.</p>
<picture data-title="macOS Package Installer icon">
<noscript class="loading-lazy">
<source media="(max-width: 640px)" srcset="https://cdn3.brettterpstra.com/uploads/2025/12/package-icon.7378_tw.jpg"/>
<source srcset="https://cdn3.brettterpstra.com/uploads/2025/12/package-icon.7378.jpg 1x, https://cdn3.brettterpstra.com/uploads/2025/12/package-icon@2x.7378.jpg 2x"/>
<img alt="macOS Package Installer icon" class="alignright" data-at2x="https://cdn3.brettterpstra.com/uploads/2025/12/package-icon@2x.7378.jpg" data-original="https://cdn3.brettterpstra.com/uploads/2025/12/package-icon.7378.jpg" height="135" src="https://cdn3.brettterpstra.com/uploads/2025/12/package-icon.jpg" title="macOS Package Installer icon" width="148"/>
</noscript>
</picture>
<p>Package Installers on Mac (<code class="language-plaintext highlighter-rouge">.pkg</code>) are those downloads that look like a cardboard box with a yellow cube coming out of it. Unlike Disk Images (<code class="language-plaintext highlighter-rouge">.dmg</code>) and Zip Archives (<code class="language-plaintext highlighter-rouge">.zip</code>), they run scripts and can install to locations you might not expect or be able to locate after install. This can be disconcerting, or at least inconvenient for people who want to know what’s going on on their machine. That’s where Suspicious Package comes in.</p>
<p>This tool will give you a Quick Look extension, so you can just select a <code class="language-plaintext highlighter-rouge">.pkg</code> file and hit Space to see what the Package Installer will do — how many files it will install, how many scripts it will run, etc.</p>
<picture data-title="Suspicious Package Quick Look Preview">
<noscript class="loading-lazy">
<source media="(max-width: 640px)" srcset="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-quick-look-800.7378_tw.jpg"/>
<source srcset="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-quick-look-800.7378.avif 1x, https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-quick-look-800@2x.7378.avif 2x" type="image/avif"/>
<source srcset="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-quick-look-800.7378.webp 1x, https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-quick-look-800@2x.7378.webp 2x" type="image/webp"/>
<source srcset="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-quick-look-800.7378.jpg 1x, https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-quick-look-800@2x.7378.jpg 2x"/>
<img alt="Suspicious Package Quick Look Preview" class="aligncenter" data-at2x="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-quick-look-800@2x.7378.jpg" data-original="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-quick-look-800.7378.jpg" height="667" src="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-quick-look-800.jpg" title="Suspicious Package Quick Look Preview" width="800"/>
</noscript>
</picture>
<p>This is not the same thing as Show Package Contents in Finder, which will give you little information about what’s going to be installed. It’s also much more informative than Show Files in the macOS Installer app.</p>
<p>Clicking on any info line in the Quick Look preview will open the Suspicious Package app to show you the exact details.</p>
<picture data-title="Suspicious Package with a PKG open">
<noscript class="loading-lazy">
<source media="(max-width: 640px)" srcset="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-app-window-800.7378_tw.jpg"/>
<source srcset="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-app-window-800.7378.avif 1x, https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-app-window-800@2x.7378.avif 2x" type="image/avif"/>
<source srcset="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-app-window-800.7378.webp 1x, https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-app-window-800@2x.7378.webp 2x" type="image/webp"/>
<source srcset="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-app-window-800.7378.jpg 1x, https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-app-window-800@2x.7378.jpg 2x"/>
<img alt="Suspicious Package with a PKG open" class="aligncenter" data-at2x="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-app-window-800@2x.7378.jpg" data-original="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-app-window-800.7378.jpg" height="694" src="https://cdn3.brettterpstra.com/uploads/2024/12/suspicious-package-app-window-800.jpg" title="Suspicious Package with a PKG open" width="800"/>
</noscript>
</picture>
<p>You can click through the app window to preview files and where they’ll be installed, scripts that will run, as well as package info and receipts. In the file viewer, you can see all the metadata for each file, including kind, permissions, and version and Bundle IDs on bundle files (e.g. Mac apps). Scripts can be previewed or opened in an external app. It provides a <a href="https://www.mothersruin.com/software/SuspiciousPackage/use.html">sweeping overview</a> of your packages, and is also <a href="https://www.mothersruin.com/software/SuspiciousPackage/scripting.html">extensively scriptable</a>.</p>
<p>Suspicious Package is free. It’s developed by Randy Saldinger (<a href="https://www.mothersruin.com/software/about.html">Mother’s Ruin Software</a>), who doesn’t even accept donations. He says his apps are labors of love, created just because he wanted them to exist. If you want to know what’s going on with your <code class="language-plaintext highlighter-rouge">.pkg</code> files (even those you trust), it’s a killer app.</p>
<p>You can follow the development <a href="https://indieapps.space/@SuspiciousPackage">on Mastodon</a> (where the <a href="https://tech.lgbt/@thebittergreen">developer is as well</a>).</p>
<p>There’s no reason not to go <a href="https://www.mothersruin.com/software/SuspiciousPackage/">get Suspicious Package today</a>.</p>