The .sppkg file packaged by the SPFx app (through
package-solution gulp commands) is actually a simple archive you can unzip.
Its content can be broken down pretty easily (xml and resource files).
One thing you can also is configure a CDN in your project, so that packaging creates the .sppkg without any web resource (JS files, images and fonts) and puts them in a separate folder for you to upload to the location of your choice.
If the objective is to analyse the actual content of the compiled JS resources, I am not able to help you unfortunately.
Hope this helps!