in Mojave > System Preferences > Security & Privacy > Privacy > Automation an Installer requires access to System Events.
How to find out to which app this belongs and eventually (if wants to sent data to some servers) how to delete it?
Best Answer
Installer is the built-in macOS app for installing packages. The Installer app itself does not belong to any app in particular; it runs any package given, usually by double-clicking a pkg from Finder.
Installer will request Automation permission when a script in a package requests such, which will occur at the time of running the package. When such a request occurred, you would be installing an app on your system, hence it would be this app’s installer scripts which would trigger this.
It took me a while to narrow down the file that contains the list of apps shown in that system pref pane, but I finally found. The list of apps is stored in /var/db/locationd/clients.plist. Once I found that juicy bit of info a quick Google search revealed this related posting on superuser.com: Remove Applications from Location Services in Security & Privacy on Mac OS X 10.8. That post is more of an answer than a question. It contains detailed step-by-step instructions on how to remove the no longer installed app from the list.
I wouldn't disable SIP if you have active malware on your system. If you have another Mac you can use or borrow, I'd boot your Mac into Target Disk Mode, connect it to the other Mac with a Thunderbolt cable, and then run both Avira and Malwarebytes on it from the other Mac. This allows the antimalware software to ignore any SIP protection on the TDM'd Mac and perform a full clean.
If you can't use another Mac, then install a bootable copy of macOS onto an external drive, boot from that, and do the same.
If you can't do either, boot into Safe Mode, run Avira, and then if it finds something, let it clean it and then reboot again into Safe Mode. Now run Malwarebytes and do the same. Always reboot after a pass where it found something, because whatever it is that it found may be preventing you from finding anything further until you reboot with it gone.
Best Answer
Installer is the built-in macOS app for installing packages. The Installer app itself does not belong to any app in particular; it runs any package given, usually by double-clicking a pkg from Finder.
Installer will request Automation permission when a script in a package requests such, which will occur at the time of running the package. When such a request occurred, you would be installing an app on your system, hence it would be this app’s installer scripts which would trigger this.