Allow me to rant for a moment here, but I despise developers that make these kinds of installers. The only reason for needing a DMG to be in the same location as a post install script is due to lazy installation packaging. There are better ways to do this if they just put a little more effort into it. The people who make these decisions clearly have no understanding that their software is often used in large deployments, pushed from a management system, and not just some poor schmo running around doing sneaker-net installations.
With that out of the way, you might have to get a little creative to get this working. For example, maybe have the script as an executable file, and the DMG all located within a new directory inside /private/tmp/ for example. Then have the real postinstall script run and call the script located in /private/tmp/beyondtrust/script.sh or whatever it's named. As long as the DMG is in that path, it should hopefully work.
You'd need to drag that "beyondtrust" folder into the Composer sidebar to create a new source, and then check the perms on everything and build it out.
