There is a suspect safari extension on a computer I'm investigating. How can I locate its install location, and possibly read the source code of the extension?

Also, is there an easy way to tell if an extension either came from the developer site, the app store, and/or is part of the Apple developer program?

Based on what I observed so far, I will need to report this developer to apple somehow.


1 Answer 1


Safari extensions are just xar archives (according to this) Open an terminal and unpack like:

xar -xf 'TheExtensionName.safariextz'

The javascript (or other) code might still be obfuscated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.