Anyone can upload an NPM package without much review. For Homebrew, you at least have to submit a pull request.

n8m8 3 days ago | parent | next [-]

https://docs.brew.sh/Acceptable-Casks#apps-that-bundle-malwa...

> Unfortunately, in the world of software there are bad actors that bundle malware with their apps. Even so, Homebrew Cask has long decided it will not be an active gatekeeper (macOS already has one) and users are expected to know about the software they are installing. This means we will not always remove casks that link to these apps, in part because there is no clear line between useful app, potentially unwanted program, and the different shades of malware—what is useful to one user may be seen as malicious by another.

---

So there might be pull requests, but Brew's official stance is that they do not actively moderate casks for malware. I guess there's something built into the MacOS packaging step that help mitigate the risk, but I don't know much about it outside playing w/ app development in XCode.

▲

what 3 days ago | parent | prev [-]

Homebrew has been compromised before. To think it’s immune is a bit naive.

	▲	n8m8 3 days ago \| parent \| next [-]
		Agreed that it's a bit funny given the context and no community-managed package manager should be 100% trusted. That said, I think rg is pretty well known to linux daily-drivers and they just wanted to share something quickly for powerusers who want to check their workspaces quickly. Probably better to just instruct n00bs to use grep than install a whole cli tool for searching Come to think of it, I wonder if a 2-phase attack could be planned by an attacker in the future: Inject malware into a package, flood guidance with instructions to install another popular tool that you also recently compromised... lol
	▲	tripplyons 3 days ago \| parent \| prev [-]
		I'm not saying its immune. I'm saying that NPM doesn't have as many protections, making NPM an easier target.