As far as "malware" is concerned, there's no reason to trust an app over a pkg. Either one is going to get you. But there are legit companies that definitely "o

As far as "malware" is concerned, there's no reason to trust an app over a pkg. Either one is going to get you. But there are legit companies that definitely "overpackage" their software. For example, Microsoft distributes Edge for Mac with a pkg installer, even though Edge is based on Chromium, and Google just distributes Chrome as a drag and drop app in a dmg. But you can extract the Edge app out of the pkg and just install that, skipping whatever junk Microsoft decides to do in their installer scripts. I trust Microsoft not to be literal malware, but I don't trust Microsoft to avoid doing stupid unnecessary crap to your Mac.