$ which xar /usr/bin/xar
/usr/bin. Does that mean it's preinstalled on mac?
One indication you might look for is found at https://opensource.apple.com/release/macos-10141.html where you see that xar-404 is indeed used by Apple.
To get a closer look at what is installed, you might use onboard tools check for some parameters:
$ codesign -vd --verbose=4 /usr/bin/xar Executable=/usr/bin/xar Identifier=com.apple.xar Format=Mach-O thin (x86_64) CodeDirectory v=20100 size=350 flags=0x0(none) hashes=7+2 location=embedded Platform identifier=2 OSPlatform=36 OSSDKVersion=658432 OSVersionMin=658432 Hash type=sha256 size=32 CandidateCDHash sha256=6dd0100231ae53fb666827d9212b487d17fa6163 Hash choices=sha256 Page size=4096 CDHash=6dd0100231ae53fb666827d9212b487d17fa6163 Signature size=4105 Authority=Software Signing Authority=Apple Code Signing Certification Authority Authority=Apple Root CA Info.plist=not bound TeamIdentifier=not set Sealed Resources=none Internal requirements count=1 size=64
As Apple doesn't offer tools like that in seperate installers or packages, the conclusion from the output above would be that it came pre-installed.
Alternatively, get the full installer ("Install macOS Mojave.app"), show package contents, navigate Contents/SharedSupport/InstallESD.dmg and mount that, then navigate to /Volumes/InstallESD/Packages/Core.pkg and open that in eg Pacifist. There as well you can navigate to /usr/bin/xar .
You can use
pkgutil to determine by which installer a file was installed:
$ pkgutil -v --file-info /usr/bin/xar volume: / path: /usr/bin/xar pkgid: com.apple.pkg.update.os.10.14.2.18C54 pkg-version: 18.104.22.168.1.1543558197 install-time: Thu Dec 6 11:31:26 2018 uid: 0 (root) gid: 0 (wheel) mode: 755 (?rwxr-xr-x ) pkgid: com.apple.pkg.update.os.10.14.1.18B75 pkg-version: 22.214.171.124.1.1540375237 install-time: Wed Nov 7 10:05:39 2018 uid: 0 (root) gid: 0 (wheel) mode: 755 (?rwxr-xr-x ) pkgid: com.apple.pkg.Core pkg-version: 10.14.0.1.1.1537503053 install-time: Tue Sep 25 10:43:44 2018 uid: 0 (root) gid: 0 (wheel) mode: 755 (?rwxr-xr-x )
xar was installed with an Apple “Core” package (and updated twice).