Interesting that the article says "DevOps engineer downloaded a tampered Homebrew installation". Are we aware of supply chain attacks against Homebrew? (I guess the internet says the engineer was tricked into downloading a modified version of Homebrew, the official download was not compromised).
Homebrew supports third party repositories so if the developer installed one that wouldn't necessarily mean a supply chain attack directly on brew-curated ones https://docs.brew.sh/Taps
> downloaded a tampered Homebrew installation “to install a popular AI coding tool after searching for it on a search engine,”
Decades of operating system development and you still don't have a simple way to install apps...
Interesting that the article says "DevOps engineer downloaded a tampered Homebrew installation". Are we aware of supply chain attacks against Homebrew? (I guess the internet says the engineer was tricked into downloading a modified version of Homebrew, the official download was not compromised).
Homebrew supports third party repositories so if the developer installed one that wouldn't necessarily mean a supply chain attack directly on brew-curated ones https://docs.brew.sh/Taps
Some more discussion: https://news.ycombinator.com/item?id=50353818
https://news.ycombinator.com/item?id=50353353
[flagged]