PKG is a macOS installer package format used to bundle and install apps, tools, or system components. A PKG can contain files, scripts, post-install actions, and metadata that tells macOS how to place software on the system. Because it is a standard distribution format, users often expect PKG files to be safe and routine.
That trust makes PKG important in cyber security. Attackers can disguise malware as a legitimate installer and rely on the victim to open it without checking the publisher, signature, or notarization status. In real attacks, malicious PKGs may drop loaders, modify system settings, or launch additional payloads during installation. Defenders should treat unknown PKGs as suspicious, verify code signing and provenance, and monitor installer behavior on high-value endpoints such as developer Macs.