How to Use the pkgutil Command in macOS Terminal to Inspect and Unpack Installer Packages

When installing corporate software, device drivers, or developer suites on macOS, software vendors routinely distribute software inside Apple Installer Packages (.pkg files). Unlike simple drag-and-drop .app bundles that reside neatly inside /Applications, installer packages frequently run root-level pre-install and post-install scripts that write system daemons, launch agents, and kernel extensions across protected system directories. The pkgutil utility provides macOS administrators and security researchers with deep insight into installer package contents, receipts, and payloads without executing untrusted installers.

Inspecting Installed Package Receipts with pkgutil

Whenever an installer package completes execution, macOS stores an installation receipt inside a protected database at /var/db/receipts/. Using pkgutil, you can query this receipt database to audit software provenance:

1. Listing All Installed Package Identifiers

pkgutil --pkgs

This command outputs every unique reverse-DNS package identifier (such as com.google.Chrome, com.apple.pkg.macOSBrain, or com.microsoft.Word) currently registered on your Mac.

2. Listing Every File Written by a Specific Package

If you need to completely uninstall a complex software package that lacks an official uninstaller, query its receipt to generate an exact inventory of every file it placed on disk:

pkgutil --files com.oracle.java8

The command lists every dynamic library, manual page, and configuration file installed by that package.

Unpacking and Extracting .pkg Files Without Running Them

For security audits, malware analysis, or extracting a single utility from a massive driver bundle without triggering system modifications, pkgutil can safely unpack .pkg files into a directory:

1. Expanding the PKG Container Hierarchy

pkgutil --expand /path/to/installer.pkg ~/Desktop/UnpackedPKG

This expands the installer into an uncompressed directory containing package metadata, Distribution XML scripts, PackageInfo manifests, and the compressed Payload archive.

2. Extracting the Underlying Payload Files

Inside the expanded folder, the actual software payload resides in a compressed CPIO archive named Payload. You can extract its contents using the native macOS cpio tool:

cd ~/Desktop/UnpackedPKG/core.pkg/
cat Payload | cpio -idmv

This unpacks the exact directory structure of the application directly onto your desktop, allowing you to inspect scripts, binaries, and certificates safely without root execution.

Re-packaging and Modifying Custom PKG Installers

Mac system administrators managing Jamf Pro, Kandji, or Microsoft Intune fleets can repackage modified folder contents back into standardized distributable installer packages:

pkgutil --flatten ~/Desktop/UnpackedPKG ~/Desktop/CustomInstaller.pkg

This flattens the directory hierarchy into a valid, signed .pkg installer ready for enterprise deployment.

Auditing Package Signature and Cryptographic Certificates

Before deploying third-party packages, verify their digital signature and Apple Developer Team ID using the companion pkgutil --check-signature command:

pkgutil --check-signature installer.pkg

The output reports the signing status (e.g., Status: signed by a developer ID certificate), the Developer Team ID, and whether Apple’s cryptographic trust chain is intact.