Homebrew 7.0.0 ships built-in vulnerability scanner

Homebrew, the open-source package manager used mostly on macOS, has released version 7.0.0 with a built-in vulnerability scanner, stronger security controls, and the full release of its native BrewUI graphical interface. Homebrew lets users install software in a way similar to Linux package managers: it automatically downloads packages and resolves and installs their dependencies, the other pieces of software a package needs to run. The new release gives macOS users and administrators a built-in way to check installed packages against known security issues.

The project's reach makes these security additions important. Homebrew has 49,000 stars and 11,000 forks on GitHub, a sign of how widely it is used. Threat actors have frequently targeted the tool to push info-stealer malware, malicious software designed to collect sensitive information from a computer, through clone sites (websites that imitate the official Homebrew page) and ClickFix lures (fake error messages or instructions that trick people into pasting harmful commands). A package manager is a valuable target because a successful compromise can affect many applications on a system at once.

BrewUI, the official native graphical interface, is now fully available on macOS 26 "Tahoe" and later. It provides an easy way to browse and search for packages and to inspect and manage their dependencies. The GUI offers a visual alternative for users who prefer not to type commands or who want a clearer view of what is installed.

The vulnerability scanner is available through a new command, brew vulns. It can check all installed formulae, a single named formula, or formulae and their dependencies declared in a Brewfile. In Homebrew, formulas (or formulae) are Ruby-based package definitions that tell Homebrew how to download files, run build commands, or install dependencies. Casks are used to install graphical applications, fonts, plugins, and other macOS software. For each formula, Homebrew determines the upstream software repository (the original project where the code lives) and its version or tag. For installed packages, the tool uses information from an available SBOM (software bill of materials, a machine-readable inventory of components) or derives the source from the formula definition.

The command sends the upstream repository and version or tag to OSV.dev, a public vulnerability database, in a batch query. It retrieves matching vulnerability records, verifies potential matches, applies optional severity filters, and finally checks whether Homebrew has already applied a security patch to that formula. This helps users distinguish between a formula that is still vulnerable and one where Homebrew has backported a fix without changing the upstream version number.

Homebrew 7.0.0 also introduces a Homebrew-specific advisory database. This database publishes OSV-format records (a common format for sharing vulnerability information) that document vulnerabilities affecting Homebrew formula versions and revisions, including fixes that have been backported without changing the upstream software version. The project team explains, "Homebrew publishes advisory findings in the formula API and a downloadable advisory index, helping other tools distinguish outstanding vulnerabilities from fixes already shipped." The records are freely reusable under CC0, a public domain license, giving security teams a shared source of Homebrew-specific vulnerability data. This means security tools and teams can consume Homebrew's advisories without needing to scrape the project's website or maintain separate mappings.

Sandboxing is also tighter in version 7.0.0. Access to users' home directories is blocked by default, and network-enabled dependency downloads are separated from offline installation. This reduces the chance that a malicious formula or cask can read files in a user's home folder or reach the network during an offline setup. Homebrew also notes that installations and upgrades are faster in the new release because it can download, prepare, and install packages concurrently, working on several at the same time.

For website owners and IT teams who run development or staging machines on macOS, keeping package managers secure is part of the broader supply chain. A malicious package or a known flaw in a dependency can expose source code, credentials, and customer data. For teams evaluating how to roll out these changes across many machines, AEU-I offers security-first IT, infrastructure and consulting that can help assess controls like Homebrew's new vulnerability scanner.