Feature request: warning for potential security risk

[aleksandr-vin]

Output of brew config

--

Output of brew doctor

--

Description of issue

The issue I've stumbled into is this: mistakenly (call it light-mindedness) issued a brew install metasploit command on a corporate computer, ended up having my account and computer in quarantine plus all the headache to myself, my manager and security team. Thinking now how that could be prevented for others, I suggest adding a voluntary NSFW tag to formulae, and stopping (or making such stop option available for those who choose it to be safe at work) the download of the payload with a warning. I would definitely be appreciating if I was stopped with a message saying smth. like "WARNING: the package can be considered as a virus/malware by AV and can lead to quarantine, continue at your own risk!"

what do you think?

[SMillerDev]

Would that show for every install every time? Because any package could be flagged by AV. I think generally the expectation is that you know what you install.

[aleksandr-vin]

This was the first time for 7 years of active installs for me. In general it can be theoretically that AV would mark every package but in practice I believe it's the sec tools and pentest ones. That's why the voluntary part of it could help: author of the formulae is willingly marking it based on the risks.