pkg.soopen package index

brew / Rang 9443

sh4d0wup mit Homebrew, Nix, pacman installieren

Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für sh4d0wup in AI-Agent-Workflows.

InstallationsbefehlSicherheitshinweise

Installation

Weitere Installationsbefehle

macOS

Homebrewverifiziert · 100%
brew install sh4d0wup

local Homebrew formula metadata

Linux

Nixverifiziert · 92%
nix profile install nixpkgs#sh4d0wup

nixpkgs package indexes · pkgs/by-name/sh/sh4d0wup/package.nix · Quelle: api.github.com

Arch Linux pacmanverifiziert · 92%
sudo pacman -S sh4d0wup

Arch Linux sync databases · sh4d0wup · Quelle: geo.mirror.pkgbuild.com

Überblick

Paketzusammenfassung

Signing-key abuse and update exploitation framework

Befehle und Aliase

  • sh4d0wup

Verlauf

Projektgeschichte und Nutzung

sh4d0wup is kpcyrd's Rust-based signing-key abuse and update-exploitation framework. It can proxy a legitimate update service, selectively alter artifacts, and sign or route malicious updates for controlled supply-chain security research.

Projektgeschichte

kpcyrd developed sh4d0wup as a Rust framework for researching 'shadow updates': targeted, malicious updates that remain acceptable to clients because they carry valid signatures. The official repository documents continued development across multiple releases and support for several package and artifact formats.

Adoptionsgeschichte

The input records packages for Homebrew, Nix, and pacman, while the official README notes an Arch Linux binary and an official container image. This reflects adoption mainly among security researchers and distribution or update-system testers rather than general application users.

Wie es verwendet wird

Security practitioners define attacks in YAML 'plot' files describing routing, selectors, artifact transformations, signatures, and keys. They can build plots in advance, launch a bait update server, proxy legitimate traffic, mutate packages or images, generate or use signing keys, and test whether an attack still executes. Plot files are user-supplied attack definitions, not a documented fixed-location application configuration file.

Warum Paket-Nerds sich dafür interessieren

sh4d0wup is notable to package specialists because it turns package metadata, artifact formats, signing infrastructure, dependency resolution, and targeted update routing into an explicit security-testing surface. It demonstrates how valid signatures alone do not guarantee that every client received the same update.

Zeitleiste

  • 2022: Examples in the official README demonstrate infection of pacman, Debian, ELF, and OCI artifacts.
  • 2025: Official repository lists version 0.11.0 released on April 2.

Related projects

  • The framework operates on ecosystems and formats including pacman packages, Debian packages, OCI images, Rust distribution updates, ELF binaries, and Git commits. The maintainer's related supply-chain work includes rebuilderd and reproducible-build experiments.

Quellen

  • Official repository and README: https://github.com/kpcyrd/sh4d0wup
  • Official repository release list: https://github.com/kpcyrd/sh4d0wup/releases
  • input.source_facts.package-manager

Sicherheitslage

Risikostufe: red

escape, surveillance, or offensive capability signal.

Risikoklassifikator

red Risiko · mittel Konfidenz · escape-surveillance-offensive

Warum

  • escape, surveillance, or offensive capability signal

Signale

  • text:exploit

Installationsverhalten

  • In den Formelmetadaten ist kein Homebrew-Post-install-Hook erfasst.
  • Homebrew-Bottle-Metadaten sind für 6 Plattformziele verfügbar.
  • Installiert mit 4 Laufzeitabhängigkeiten.
  • Build-Metadaten listen 3 Build-Abhängigkeiten.

Empfohlene Prüfung

Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.

Executables

Installierte Executables

BefehlArtSichtbarkeitHinweis
sh4d0wupcliglobales Executable

Aktualität

Version und Aktualität

Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.

Seite generiert2026-09-19
Manager-Version0.11.1
Manager aktualisiert2026-09-14
lokale DatenOK
Upstreamaktuell
neueste erkannte Versionv0.11.1

https://github.com/kpcyrd/sh4d0wup

  • OKEs wurden keine Aktualitätswarnungen generiert.

Installationsmetadaten

Paketmetadaten

Paketschlüsselbrew:sh4d0wup
Version0.11.1
PaketmanagerHomebrew
Paketmanager-Seitehttps://formulae.brew.sh/formula/sh4d0wup
Homepagehttps://github.com/kpcyrd/sh4d0wup
Repositoryhttps://github.com/kpcyrd/sh4d0wup
LizenzGPL-3.0-or-later
Quellarchivhttps://github.com/kpcyrd/sh4d0wup/archive/refs/tags/v0.11.1.tar.gz
Zuletzt aktualisiert2026-09-14T12:20:55+02:00
Pulseupdated
Abhängigkeitenopenssl@3, pcsc-lite, xz, zstd
Build-Abhängigkeitenllvm, pkgconf, rust
Bottleverfügbar (auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnicht definiert
Dienstkeiner deklariert

Registry-Fakten

Details aus der Quelldatenbank

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namesh4d0wup
Version Scheme0
Revision0
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • stable

Source-Datenbank-Treffer

Andere Paketmanager-Einträge

Treffer stammen aus externen Paketmanager-Indizes und bleiben von lokalen Automic-Vault-Paketlinks getrennt.

Nix95%

sh4d0wup

nix profile install nixpkgs#sh4d0wup
  • normalized package name match
  • Abgeglichen nach: Sh4d0wup
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/sh/sh4d0wup/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
pacman95%

sh4d0wup 0.11.1-1

Signing-key abuse and update exploitation framework

https://github.com/kpcyrd/sh4d0wup

sudo pacman -S sh4d0wup
  • License: GPL-3.0-or-later
  • Architecture: x86_64
  • 14 Abhängigkeiten
  • normalized package name match
  • Abgeglichen nach: Sh4d0wup
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: sh4d0wup from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

Paketgraph

Links stammen aus dem lokalen Paketbeziehungsgraph, Ergänzungen, Abhängigkeitskanten, Ecosystem-Matches und Paket-Hub-Mitgliedschaft.

Verwandte Tools

  • openssl@3Runtime dependency declared by Homebrew.
  • xzRuntime dependency declared by Homebrew.
  • zstdRuntime dependency declared by Homebrew.
  • pcsc-liteRuntime dependency declared by Homebrew.
  • pkgconfBuild dependency declared by Homebrew.
  • llvmBuild dependency declared by Homebrew.
  • rustBuild dependency declared by Homebrew.

Gleicher Workflow

  • malcontentShares pkgdb curated category or tags: cli, security, supply-chain-security.
  • slsa-verifierShares pkgdb curated category or tags: cli, security, supply-chain-security.
  • minderShares pkgdb curated category or tags: cli, security, supply-chain-security.
  • bumblebeeShares pkgdb curated category or tags: cli, security, supply-chain-security.
  • depsguardShares pkgdb curated category or tags: cli, security, supply-chain-security.
  • chain-benchShares pkgdb curated category or tags: cli, security, supply-chain-security.

Quellspur

Aus Repository-Daten generiert

Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.

Verwendete Quellen

  • Geiger risk classifier
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment
  • pkg.so package database
  • pkgdb category and tag curation