Suspicious Package for Mac
Preview contents of installer packages.
When you purchase through links on our site, we may earn an affiliate commission
Suspicious Package overview
With Suspicious Package, you can find out important information about those package files you download. Do you know what files that OS X Installer package actually installs?... Do you know what scripts it runs during installation, and what they do?... Do you know who the package really came from?... Maybe you're quite literally suspicious of a package you've downloaded. Or perhaps you're just curious about what some package does. Or maybe you want to find out after the fact exactly what files a package scattered across your computer. Whatever the reason, Suspicious Package allows you to see inside an installer package. (And it's completely free.)
Suspicious Package is now actually both an OS X application,... and a plug-in for the Quick Look feature of OS X.
What’s new in version 4.6.1
- Fixed a bug in how entitlements with dictionary values (such as
com.apple.security.scripting-targets) were handled. This bug could've resulted in the File > Show Entitlements for Item command showing incorrect entitlement values, or even an outright crash immediately after Suspicious Package finished analyzing the payload, depending on the exact structure of the entitlements found. (For example, the recent Security Update 2026-001 for macOS 10.15 would trigger Suspicious Package to crash.) - Fixed a bug in how entitlements with inconsistent value types (across different components) were handled. This bug could've caused the File > Show Entitlements for All Executables command to get stuck while “Getting all entitlements,” or to show a confusing representation of the merged entitlement value.
- Updated the Review warning for bundle-style distribution metapackages to reflect that these are now rejected as “legacy installer packages” as of macOS 26.1.
- Removed the Review warnings that a package “appears to install Apple content,” but either “isn't signed” or “is signed with a non-Apple identity.” Apple is being less consistent about what kinds of certificates they use to sign their own software — for example, the container package is signed with a third-party style Developer ID Installer certificate — so this check seemed more confusing than helpful in 2026. Suspicious Package will still warn about unsigned packages generally, but not in a different way based on whether or not it appears to contain Apple content.
- Suspicious Package's notarization ticket is now “stapled” to the
app bundle instead of to the containing disk image file. This isn't supposed
to make a difference — since macOS normally reads the ticket from the dmg when that's first
opened — but it might avoid some problems when the app is installed via mechanisms like
Homebrew (which uses
hdiutil(1), and thus doesn't trigger the notarization ticket to be processed). This ought to matter only if your Internet connection is unavailable when the app is initially launched, since otherwise macOS will fetch a ticket from Apple servers.
Suspicious Package for Mac
Free
In English
Version 4.6.1
Write a detailed review about Suspicious Package
What customer like
Performance
What needs improvements
Customization
(18 Reviews of Suspicious Package)
Comments
User Ratings
Dec 16 2022
Version: 4.3.1
Unfortunately the new version is for Big Sur or higher.
But I highly recommend this app for anyone "curious" or "paranoid"
You can see inside installers and make your digital life a bit more secure.
Mar 17 2022
Version: 4.2
...it is very complete; what happens is that I have little need to use it ...
Jul 11 2020
Version: 3.5.3
Very impressed. Software is exceptionally well designed, easy to use, and teaches the user about how installer packages are created though Suspicious Package's use. While I love Pacifist, Suspicious Package (SP) has become my go-to and I set it as my default '.pkg' file opener.
It would be awesome if SP could have a setting where you drag your favorite anti-virus software into an image well and it would then offer the ability to open whatever package you are analyzing into that AV software whenever you run SP. (sub launch with file)
May 8 2019
Version: 3.4.1
Essential tool to see what sorts of sneaky sludge an app may want to stuff into your system.
Oct 8 2018
Version: 3.3.2
Love this app. Very convenient way to figure out what will be installed by a .pkg beforehand. I mostly use it through QuickLook, but the app itself provides additional features that are quite handy too.
