Homebrew 7.0.0 adds built-in vuln scanner

Homebrew has long been the default way to install software on a Mac, and its popularity has made it a recurring target for malware distribution. The project's 7.0.0 release, detailed in a project announcement, tries to address that risk directly with a built-in vulnerability scanner, a dedicated advisory database, and tighter sandboxing — alongside the full release of its native graphical interface.

A GUI arrives on macOS Tahoe

The headline feature for many users will be BrewUI, the official native graphical interface for Homebrew. According to the project, BrewUI is available on macOS 26 "Tahoe" and later and makes it easy to browse and search for packages, as well as inspect and manage their dependencies.

The package manager itself is primarily used on macOS, allowing users to install software in a similar way to Linux package managers by automatically downloading packages and resolving and installing their dependencies. Until now, that workflow has been almost entirely command-line driven, which has kept a meaningful segment of Mac users away from the tool or pushed them toward third-party front ends.

BrewUI arrives as a full release rather than a preview, and the project frames it as an official native interface rather than a wrapper. That distinction matters for anyone who has previously relied on unofficial GUI clients that may lag behind Homebrew's own feature set.

The new brew vulns command

Homebrew 7.0.0 adds a vulnerability scanner that users can invoke through a new command, brew vulns. The command can check installed formulae, a specific one, or formulae and their dependencies declared in a Brewfile.

The mechanics are worth understanding, because the scanner does more than match version strings against a list. For each formula, Homebrew determines the upstream software repository and its version or tag. For installed packages, it uses information from the available SBOM or derives the source from the formula definition.

The command then sends the upstream repository and version or tag to OSV.dev in a batch query, retrieves the vulnerability records, verifies potential matches, applies optional severity filters, and finally checks whether Homebrew has already applied a security patch to that formula. That last step is the part that separates a useful result from a noisy one: a formula can report an older upstream version that carries a fix backported by Homebrew maintainers without the version number changing.

An advisory database built for Homebrew

Separately from the scanner, Homebrew has stood up its own advisory database. It publishes OSV-format records documenting vulnerabilities affecting Homebrew formula versions and revisions, including fixes that have been backported without changing the upstream software version.

"Homebrew publishes advisory findings in the formula API and a downloadable advisory index, helping other tools distinguish outstanding vulnerabilities from fixes already shipped."

— the Homebrew project team

"The database's OSV-format records are freely reusable under CC0, giving security teams a shared source of Homebrew-specific vulnerability data."

— the Homebrew project team

The CC0 licensing is notable for anyone building dependency-scanning pipelines. Homebrew-specific data has historically been awkward to consume because generic vulnerability feeds do not track formula revisions or backported patches. An openly reusable index gives other tools a way to ingest that signal without negotiating separate terms.

Sandboxing and faster installs

Homebrew 7.0.0 also tightens default sandboxing. Access to users' home directories is now blocked by default, and network-enabled dependency downloads are separated from offline installation.

Both changes reduce the blast radius of a compromised formula or a tampered dependency. Blocking home-directory access by default means a build step that tries to read a user's documents, SSH keys, or browser profile fails unless it has been explicitly allowed. Splitting network-enabled downloads from offline installation limits the window in which a package's build process can reach out to the network.

Users also get better performance: the project notes that installations and upgrades are faster in the new release, thanks to a new ability to download, prepare, and install packages concurrently.

A package manager worth attacking

The security work in 7.0.0 did not arrive in a vacuum. Homebrew's popularity is obvious from its 49k stars and 11k forks on GitHub, and threat actors have frequently targeted it to push info-stealer malware, including through clone sites and ClickFix lures.

Those campaigns do not necessarily exploit Homebrew itself. Clone sites impersonate legitimate project pages to serve malicious installers, while ClickFix lures trick users into running attacker-supplied commands under the guise of fixing an error. Both approaches lean on the trust users place in a package manager and the command-line instructions they are accustomed to pasting.

This is why the advisory database and scanner matter beyond routine hygiene. The project is building tooling that can tell the difference between a formula with an outstanding vulnerability and one where a fix has already been backported — a distinction that generic scanners frequently get wrong.

What the scanner actually checks

Homebrew manages two distinct kinds of packages, and the scanner accounts for both. Casks are used to install graphical applications, fonts, plugins, and other macOS software. Formulae are Ruby-based package definitions that can instruct Homebrew to download files, run build commands, or install dependencies.

Because formulae are executable definitions rather than simple archives, source provenance is central to the new scanner's design. Deriving an upstream repository and version or tag from a formula lets Homebrew query OSV.dev with a concrete coordinate rather than a guess, and the verification step afterward is intended to cut down on false matches.

Severity filters are optional, which means teams can decide how much noise they want in their results. The ability to scan an entire Brewfile makes the command usable in CI, where a project's declared dependencies can be checked as part of a build pipeline rather than only after installation.

The practical migration picture

Nothing in the release notes suggests Homebrew is abandoning its command-line foundation, and the new interface is additive. For existing users, the most immediate changes are behavioral: home-directory access is blocked by default in the sandbox, and network-enabled dependency downloads are now separated from offline installation.

• 49k stars and 11k forks on GitHub for the Homebrew project
• BrewUI requires macOS 26 "Tahoe" or later
• Advisory records are published in OSV format under CC0
• New command: brew vulns, usable against installed formulae, a specific formula, or a Brewfile

Users who maintain automated build environments may need to audit scripts that relied on reading from home directories or on network access during offline phases. Those are the kinds of changes that tend to surface as build failures rather than as obvious security warnings, so testing before rolling 7.0.0 into a pipeline is the sensible path.

Why this matters beyond Mac users

Homebrew's security posture is worth watching even for teams that never touch a Mac. The project has effectively built a Homebrew-specific vulnerability feed, published it in a standard format, and released it under a license that lets anyone reuse it. That combination is unusual in package-manager ecosystems, where vulnerability data is often either proprietary, incomplete, or disconnected from the revisions that actually ship to users.

For defenders, the practical implication is that dependency scanning on macOS can now distinguish between an upstream flaw and a bug Homebrew has already patched through a backport. That reduces the number of alerts that require manual triage, which is the difference between a scanner people run and one they ignore.

The broader signal is that the project is treating its own distribution channel as an attack surface, not just a convenience. Threat actors have repeatedly used Homebrew's name to push info-stealer malware through clone sites and ClickFix lures, and while no version of the package manager can stop a user from pasting a malicious command, tighter sandboxing and clearer vulnerability data raise the cost of the adjacent attacks. Whether that shifts attacker behavior is an open question, but the tooling now exists where it largely did not before.