4 ms·

The installer needs root (admin) permission, which may be abused.

• pjmlp 6y ago
  Having access to $HOME is already gone enough to produce irrecoverable damage, specially if there is Internet connection.
  • blub 6y ago
    Modern macOS doesn't give access to specific home subfolders to apps.
    • pjmlp 6y ago
      Which not everyone is using, this is only enabled since Catalina.
  • 2cb 6y ago
    To add to blub's response, macOS operates on a permissions system similar to iOS. A new application has to ask permission the first time it tries to access anything in your home folder. Moreover, it is also quite granular. You can allow access to "Downloads" but still have to grant permission for it to access "Documents" later.
    • pjmlp 6y ago
      Only since Catalina.
  • _qulr 6y ago
    As far as "malware" is concerned, there's no reason to trust an app over a pkg. Either one is going to get you. But there are legit companies that definitely "overpackage" their software. For example, Microsoft distributes Edge for Mac with a pkg installer, even though Edge is based on Chromium, and Google just distributes Chrome as a drag and drop app in a dmg. But you can extract the Edge app out of the pkg and just install that, skipping whatever junk Microsoft decides to do in their installer scripts. I trust Microsoft not to be literal malware, but I don't trust Microsoft to avoid doing stupid unnecessary crap to your Mac.
    • forgotmypw17 6y ago
      I would consider mandatory "telemetry" to be malware-ish...