While there isn't a single "famous" paper with this exact title, this specific behavior is a central theme in several notable security research publications:
: Research on Software Supply Chain Attacks often uses "remote pkg installers" as a primary case study for how legitimate package management tools can be subverted to execute remote code. Download remote pkg installer pkg
: High-profile reports from security firms like SentinelOne , Objective-See , and Jamf often cite this exact string when documenting macOS-specific adware or trojans (such as Shlayer or Bundlore ). These papers detail how scripts use curl or wget to "download remote pkg installer" files to bypass standard gatekeeper protections. While there isn't a single "famous" paper with