PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Our audit of Homebrew

blog.trailofbits.com | blog | #security-audit | #ci-cd | #macos | #supply-chain-security | #trail-of-bits | #package-manager | #homebrew
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits' Open Tech Fund-sponsored audit of Homebrew found non-critical flaws enabling unexpected code loading and CI/CD attacks that could tamper with bottle builds and exfiltrate secrets.
Published
Collected

Related coverage

blog · hunt.io
Odyssey Stealer & AMOS Hit macOS Developers with Fake Homebrew Sites
A macOS campaign targeting developers via fake Homebrew, TradingView and LogMeIn download portals delivered Odyssey Stealer and AMOS, with 85+ phishing domains tied to multi-year infrastructure.
research · hunt.io
Fake Homebrew Pages Deliver Cuckoo Stealer via ClickFix | macOS Threat Hunting Analysis
Homebrew typosquats delivered Cuckoo Stealer via ClickFix: a first stage stole credentials via dscl authonly prompts, then a macOS infostealer/RAT hitting 20+ wallets and persisting via LaunchAgent.
blog · blog.trailofbits.com
Your AI agent fixed the bug, but what else did it change?
We’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents.
blog · blog.trailofbits.com
Package managers have an integrity problem
# Package managers have an integrity problem Keegan Ryan October 14, 2026 supply-chain, cryptography, ecosystem-security Page content * Simulating malicious package repositories * HTTPS is...
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
Back