For *.pkg installers there is Suspicious Package at least.

https://www.mothersruin.com/software/SuspiciousPackage/