Homebrew
macOS package manager abuse techniques
high
Code Execution
Legacy Cask Flight Block Arbitrary Ruby Execution
Homebrew historically supported `preflight`, `postflight`, `uninstall_preflight`, and `uninstall_postflight` blocks containing arbitrary …
macOS
high
Code Execution
Cask pkg and installer script Privilege Escalation
The Cask DSL provides a `pkg` stanza for a macOS package and an `installer script:` stanza for an executable. These vendor-supplied …
macOS
high
Code Execution
Trusted Third-Party Homebrew Formula Code Execution
Homebrew formulae are Ruby package definitions. Official formula installs normally use signed JSON metadata and reviewed bottles, while …
macOS
Linux
high
Supply Chain
Trusted Third-Party Tap Supply Chain
`brew tap /` clones a third-party repository that can provide formulae, casks, and external commands, but tapping alone does not grant …
macOS
Linux