Our audit of Homebrew

Summary: Trail of Bits performed an audit of Homebrew's brew CLI and three adjacent security-relevant repositories, finding issues that, while not critical, could allow an attacker to load executable code at unexpected points and undermine the integrity guarantees intended by Homebrew's sandboxing. The audit also found CI/CD issues that could let an attacker surreptitiously modify bottle builds of formulae and pivot from triggering workflows to controlling their execution and exfiltrating secrets.
What's compelling: Homebrew serves hundreds of millions of package installs annually, including keystone packages such as Golang, Node.js, and OpenSSL, so the integrity of its builds is critical to downstream software ecosystems as a whole. The report notes that a lower-privileged insider, such as a rogue maintainer, could leverage misuse-prone GitHub Actions patterns to undermine the integrity and isolation assumptions of Homebrew's CI/CD.

Read the original at Trail of Bits Blog ↗