macOS
Homebrewverified · 100%
brew install sh4d0wuplocal Homebrew formula metadata
brew
Install sh4d0wup with Homebrew, Nix, pacman
Signing-key abuse and update exploitation framework. Version 0.11.0 via Homebrew; verified 2026-06-22.
install
Additional install commands
Linux
Nixverified · 92%
nix profile install nixpkgs#sh4d0wupnixpkgs package indexes · pkgs/by-name/sh/sh4d0wup/package.nix · source: api.github.com
Arch Linux pacmanverified · 92%
sudo pacman -S sh4d0wupArch Linux sync databases · sh4d0wup · source: geo.mirror.pkgbuild.com
overview
Package summary
Signing-key abuse and update exploitation framework
Project links
Commands and aliases
- sh4d0wup
security posture
Risk level: red
escape, surveillance, or offensive capability signal.
Risk classifier
red risk · medium confidence · escape-surveillance-offensive
Why
- escape, surveillance, or offensive capability signal
Signals
- text:exploit
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 8 platform targets.
- Installs with 4 runtime dependencies.
- Build metadata lists 3 build dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
sh4d0wup | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version0.11.0
manager updated2026-06-22
local dataok
upstreamcurrent
latest detectedv0.11.0
https://github.com/kpcyrd/sh4d0wup
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:sh4d0wup |
|---|---|
| Version | 0.11.0 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/sh4d0wup |
| Homepage | https://github.com/kpcyrd/sh4d0wup |
| Repository | https://github.com/kpcyrd/sh4d0wup |
| Upstream docs | https://github.com/kpcyrd/sh4d0wup#readme |
| License | GPL-3.0-or-later |
| Source archive | https://github.com/kpcyrd/sh4d0wup/archive/refs/tags/v0.11.0.tar.gz |
| Last updated | 2026-06-22T14:06:16-07:00 |
| Pulse | updated |
| Dependencies | openssl@3, pcsc-lite, xz, zstd |
| Build dependencies | llvm, pkgconf, rust |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, sonoma, ventura, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | sh4d0wup |
| Version Scheme | 0 |
| Revision | 0 |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Nix95%
sh4d0wup
nix profile install nixpkgs#sh4d0wup- normalized package name match
- Matched by: Sh4d0wup
pacman95%
sh4d0wup 0.11.0-2
Signing-key abuse and update exploitation framework
https://github.com/kpcyrd/sh4d0wup
sudo pacman -S sh4d0wup- License: GPL-3.0-or-later
- Architecture: x86_64
- 13 dependencies
- normalized package name match
- Matched by: Sh4d0wup
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment