I saw these three console entries today:
2015-02-10 17:31:05.596 pkd[451]: UNINSTALLED:com.apple.Preview.Markup com.apple.Preview.Markup(1.0) 0E04B4EC-64DB-4C7F-B79B-AD11187C18FF /Applications/Preview.app/Contents/PlugIns/Markup.appex
2015-02-10 17:31:05.600 pkd[451]: INSTALLED:com.apple.Preview.Markup com.apple.Preview.Markup(1.0) <__NSConcreteUUID 0x7fb3b8f4d030> 5DD65E58-F722-4DF9-9850-6098D7ADC739 /Applications/Preview.app/Contents/PlugIns/Markup.appex
2015-02-10 17:31:05.653 pkd[451]: PLUGIN REMOVAL:com.apple.Preview.Markup RESULT:3
I do not know what triggered that uninstall/install process.
I have seen that Markup.appex Preview plug-in in other two OS X Yosemite systems, but not in a stock OS X Mavericks system. The plug-in appears to be legitimate, apparently providing some Mail functionality.
But why would the pkg process remove and reinstall it today, with no warning or explanation (in the form of an entry in “Updates installed in the last 30 days” list in the App Store app?
The App Store app doesn’t show that anything got updated today.
Even though the Extensions preferences pane in System Preferences refers to extesions as “third-party” software, Google doesn’t provide me the possible developer for the Markup.appex extension.
I doubt that (if the plug-in is an Apple product), Apple would update it silently, unless this is a security problem being plugged.
I appreciate any insight into this by someone who is familiar with the plug-in or knows how third-party extensions are updated.