Suspicious Package

Name: Suspicious Package
Rating: 5 (18 reviews)

Version 4.4

Follow this app Developer website

Free

Absolutely Free

Download (6.6 MB)

Suspicious Package overview

With Suspicious Package, you can find out important information about those package files you download. Do you know what files that OS X Installer package actually installs?... Do you know what scripts it runs during installation, and what they do?... Do you know who the package really came from?... Maybe you're quite literally suspicious of a package you've downloaded. Or perhaps you're just curious about what some package does. Or maybe you want to find out after the fact exactly what files a package scattered across your computer. Whatever the reason, Suspicious Package allows you to see inside an installer package. (And it's completely free.)

Suspicious Package is now actually both an OS X application,... and a plug-in for the Quick Look feature of OS X.

What’s new in version 4.4

Updated on Feb 27 2024

Added File > Show Launch Information for Item, which can be used on code-signed bundles or executables. It shows the code signing identity, as well as any explicit launch constraints that will gate the launch of that component on macOS 14 (Sonoma).
Added support for using Beyond Compare for the File > Compare Packages command. This can be configured via Suspicious Package > Preferences > Compare > Compare Packages Using.
Added a Swedish localization — thanks to Frank Winterpil for making this possible!
Updated the French localization — thanks to Olivier Prompt for keeping this going for so many years!
When using File > Show Item as Property List, you can now Control-click on an item (whether dictionary key or array item) to copy various bits to the clipboard: the key, the value or a new property list with just that item, in XML format. If the value is a pure data type, you can copy it as a hex string, or export it to a new file.
When using File > Show Item as Property List on Info.plist files, File > Show Entitlements for Item, or File > Show Entitlements for All Executables, recent search terms will now be preserved across packages and app launches.
Improved the handling of certain packages containing executables with older 32-bit Intel (or still older PowerPC) architecture support, so that they don't show (confusingly) as having “mixed Apple Silicon and Intel support” on the Package Info tab.
Fixed a bug where Kaleidscope 4 might not be able to be selected via Suspicious Package > Preferences > Compare > Compare Packages Using. If you had Kaleidscope 3 previously configured, version 4 would've worked, but Suspicious Package got confused because version 4 has a different bundle identifier. Now it should properly recognize version 4 and/or 3 in the UI. (In either case, Suspicious Package uses /usr/local/bin/ksdiff to initiate a compare, and it's up to that tool to choose which app to talk to.)
Fixed a bug where the entitlements for certain executables were not properly shown. (DER-format entitlements with dictionary values were not correctly decoded.)
Avoid triggering the macOS alert that “Suspicious Package would like to access data from other apps” when previewing a macOS Full Installer package. As explained here, Suspicious Package wasn't trying to access the data from anything other than its own Quick Look Preview extension, and it didn't really matter if you disallowed it. But it was annoying!
When exporting an item from a package, Suspicious Package will now ensure that all files are both readable and writable for the current user, regardless of the permissions specified by the package. It has always done this for directories (largely so that the exported item can be easily removed after examination), but non-writable files can trigger other subtle problems, such as not being able to remove the quarantine attribute and possibly triggering the app translocation behavior. Note that Suspicious Package has always ignored the package-specified ownership when exporting — one of the many ways that exporting is not installing.
Allow the use of File > Show Package in Finder (Cmd-Option-R) from the Welcome to Suspicious Package window, in case you want to reveal the selected package without having to open it first.
Removed support for macOS 11 (Big Sur).

View older Suspicious Package updates

Information

License

Free

Size

6.6 MB

Developer’s website

https://www.mothersruin.com/software/SuspiciousPackage/

Downloads

20972

App requirements

Intel 64
Apple Silicon
macOS 12 or later

0.0

(0 Reviews of )

There are no reviews yet

Comments
User Ratings

Ironman

Dec 16 2022

4.3.1

Version: 4.3.1

Unfortunately the new version is for Big Sur or higher. But I highly recommend this app for anyone "curious" or "paranoid" You can see inside installers and make your digital life a bit more secure.

enriqueapolinar

Mar 17 2022

4.2

Version: 4.2

...it is very complete; what happens is that I have little need to use it ...

Cerniuk

Jul 11 2020

3.5.3

5.0

Version: 3.5.3

Very impressed. Software is exceptionally well designed, easy to use, and teaches the user about how installer packages are created though Suspicious Package's use. While I love Pacifist, Suspicious Package (SP) has become my go-to and I set it as my default '.pkg' file opener. It would be awesome if SP could have a setting where you drag your favorite anti-virus software into an image well and it would then offer the ability to open whatever package you are analyzing into that AV software whenever you run SP. (sub launch with file)

tomtomklub

May 8 2019

3.4.1

Version: 3.4.1

Essential tool to see what sorts of sneaky sludge an app may want to stuff into your system.

Cortig

Oct 8 2018

3.3.2

Version: 3.3.2

Love this app. Very convenient way to figure out what will be installed by a .pkg beforehand. I mostly use it through QuickLook, but the app itself provides additional features that are quite handy too.

june8

Aug 10 2018

Very useful application. Thanks to the developer.

Zsoltmagscreen

Sep 27 2016

3.2

Version: 3.2

small, quick, nice clean and simple design, does all what you mostly want to do with the package. Highly recommended

umaromc

Mar 2 2016

3.0

Version: 3.0

Ran through virustotal.com AVG: OSX/InstallCore.O Ikarus: PUA.OSX.Adware False positives?

hugelshofer

Mar 1 2016

2.0.2

Version: 2.0.2

@MacUpdate: Please update the links to actual downloads

Donmontalvo

Nov 23 2015

Simple, effective, free, and the developer allows distribution in enterprise. I wish charlessoft would rope this baby in to replace their Pacifist plug-in. :) Don

B-Jefferson-Le-Blanc

Feb 4 2015

2.0.1

Version: 2.0.1

I'd forgotten that I installed this some time ago. But the installer will detect an older version and write the new version over the old, in the same location, to prevent duplication. Very cool. SP is especially useful to find software install locations, which can be useful when you wish to uninstall something. I have to agree, five stars.

Wts

Sep 5 2014

2.0

Version: 2.0

A very useful pkg albeit still prefer using unpkg because it creates a copy of the actual package which for me makes it easier to uninstall if the software is not what i want. I still rate this software at 5 because it gives me a fast look at what is installed and where. Perhaps making a screen shot would help me later on if i would need to uninstall a software that was installed by .pkg.

Nov 8 2013

1.3

Version: 1.3

Does Suspicious Package support Mavericks?

GeogProf

Sep 12 2011

1.2

Version: 1.2

Works well in Lion (10.7.1). I installed it in the top-level QuickLook folder instead of my User folder & didn't have to log out & in again. Gives lots of good info on packages without having to open them. Love it, love the price.