How to reverse engineer a malicious macOS pkg installer?

How to extract the content of a malicious macOS pkg installer and reverse engineer it?