安装

其他安装命令

macOS

Homebrew已验证 · 100%

brew install sh4d0wup

local Homebrew formula metadata

Linux

Nix已验证 · 92%

nix profile install nixpkgs#sh4d0wup

nixpkgs package indexes · pkgs/by-name/sh/sh4d0wup/package.nix · 来源: api.github.com

Arch Linux pacman已验证 · 92%

sudo pacman -S sh4d0wup

Arch Linux sync databases · sh4d0wup · 来源: geo.mirror.pkgbuild.com

概览

软件包摘要

Signing-key abuse and update exploitation framework

项目链接

命令和别名

sh4d0wup

历史

项目历史与用法

sh4d0wup is kpcyrd's Rust-based signing-key abuse and update-exploitation framework. It can proxy a legitimate update service, selectively alter artifacts, and sign or route malicious updates for controlled supply-chain security research.

项目历史

kpcyrd developed sh4d0wup as a Rust framework for researching 'shadow updates': targeted, malicious updates that remain acceptable to clients because they carry valid signatures. The official repository documents continued development across multiple releases and support for several package and artifact formats.

采用历史

The input records packages for Homebrew, Nix, and pacman, while the official README notes an Arch Linux binary and an official container image. This reflects adoption mainly among security researchers and distribution or update-system testers rather than general application users.

使用方式

Security practitioners define attacks in YAML 'plot' files describing routing, selectors, artifact transformations, signatures, and keys. They can build plots in advance, launch a bait update server, proxy legitimate traffic, mutate packages or images, generate or use signing keys, and test whether an attack still executes. Plot files are user-supplied attack definitions, not a documented fixed-location application configuration file.

为什么软件包爱好者会关心

sh4d0wup is notable to package specialists because it turns package metadata, artifact formats, signing infrastructure, dependency resolution, and targeted update routing into an explicit security-testing surface. It demonstrates how valid signatures alone do not guarantee that every client received the same update.

时间线

2022: Examples in the official README demonstrate infection of pacman, Debian, ELF, and OCI artifacts.
2025: Official repository lists version 0.11.0 released on April 2.

Related projects

The framework operates on ecosystems and formats including pacman packages, Debian packages, OCI images, Rust distribution updates, ELF binaries, and Git commits. The maintainer's related supply-chain work includes rebuilderd and reproducible-build experiments.

来源

Official repository and README: https://github.com/kpcyrd/sh4d0wup
Official repository release list: https://github.com/kpcyrd/sh4d0wup/releases
input.source_facts.package-manager

安全态势

风险级别：red

escape, surveillance, or offensive capability signal.

风险分类器

red 风险 · 中置信度 · escape-surveillance-offensive

原因

escape, surveillance, or offensive capability signal

信号

text:exploit

安装行为

formula 元数据中未记录 Homebrew post-install 钩子。
Homebrew bottle 元数据适用于 6 个平台目标。
安装时包含 4 个运行时依赖。
构建元数据列出 3 个构建依赖。

建议审查

在无人值守的代理使用前，请检查该工具是否读取明文凭据、写入远程状态、发布制品或调用插件。

可执行文件

已安装的可执行文件

命令	类型	暴露范围	备注
`sh4d0wup`	cli	全局可执行文件

新鲜度

版本和新鲜度

这些信号区分页生成时间、软件包管理器活动和上游发布比较。只有存在证据 URL 和可比较版本时，才会提示版本落后。

页面生成时间2026-09-19

管理器版本0.11.1

管理器更新时间2026-09-14

本地数据OK

上游当前

检测到的最新版本v0.11.1

https://github.com/kpcyrd/sh4d0wup

OK没有生成新鲜度警告。

安装元数据

软件包元数据

软件包键	brew:sh4d0wup
版本	0.11.1
软件包管理器	Homebrew
软件包管理器页面	https://formulae.brew.sh/formula/sh4d0wup
主页	https://github.com/kpcyrd/sh4d0wup
仓库	https://github.com/kpcyrd/sh4d0wup
许可证	GPL-3.0-or-later
源码归档	https://github.com/kpcyrd/sh4d0wup/archive/refs/tags/v0.11.1.tar.gz
最后更新	2026-09-14T12:20:55+02:00
Pulse	updated
依赖	openssl@3, pcsc-lite, xz, zstd
构建依赖	llvm, pkgconf, rust
Bottle	可用 (于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	未定义
服务	未声明

注册表事实

源数据库详情

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	sh4d0wup
Version Scheme	0
Revision	0
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	stable

源数据库匹配

其他软件包管理器记录

匹配项来自外部软件包管理器索引，并与本地 Automic Vault 软件包链接分开显示。

Nix95%

sh4d0wup

nix profile install nixpkgs#sh4d0wup

normalized package name match
匹配方式：Sh4d0wup

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/sh/sh4d0wup/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

pacman95%

sh4d0wup 0.11.1-1

Signing-key abuse and update exploitation framework

https://github.com/kpcyrd/sh4d0wup

sudo pacman -S sh4d0wup

License: GPL-3.0-or-later
Architecture: x86_64
14 依赖
normalized package name match
匹配方式：Sh4d0wup

Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: sh4d0wup from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

软件包图谱

链接来自本地软件包关系图、补充数据、依赖边、生态匹配和软件包 hub 归属。

来源线索

由仓库数据生成

此页面由 av-web 从 scripts/generate-pkg-sqlite.py 生成的私有软件包 SQLite 工件提供。

Combined YAML source

View the package source record on GitHub.

combined/sh4d0wup.yml

使用的来源

Geiger risk classifier
cross-ecosystem install command graph
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment
pkg.so package database
pkgdb category and tag curation

使用 Homebrew, Nix, pacman 安装 sh4d0wup