OUR AUDIT OF HOMEBREW

Summary from the TLDR InfoSec newsletter

Trail of Bits performed an audit of the popular macOS package manager, Homebrew. The audit found several issues in the brew CLI that could allow for unsandboxed, local code execution but this was in line with Homebrew's threat model of trusted formulae. The audit also uncovered misuse-prone patterns in the CI/CD process that could allow a lower-privileged insider to undermine the integrity and isolation assumptions made by the Homebrew CI/CD.