Replace a developer tool in a user-writable prefix

Code Security SCM Posture

Package managers no longer install into directories only root can write.
On Apple silicon Homebrew lives in /opt/homebrew, and the same pattern
covers ~/.pyenv, ~/.nvm, ~/.local/bin, ~/.cargo/bin and every
user-scoped shim a developer adds to PATH. The logged-in user owns
those trees. Malware already running as that user can therefore delete
a tool, write its own copy in the same place under the same name, and
re-point the symlink on PATH — no privilege prompt, no installer, no
package manager, no new file in a directory that a scanner watches.

The replacement is persistence that looks like the environment. It
runs when the developer's own shell resolves the tool, so the operator
gets command execution on demand, at login, and in every later
terminal, and the implant has no listening socket and no running
process between calls. Because the file name, path and permissions are
those of the tool that was there before, an inventory of installed
software still lists it as installed.

Binance's October 2026 findings are the reference case. On an
engineer's work laptop, code from a recruitment-assignment repository
created /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_ (3,414 bytes),
wrote the payload into it, deleted the real libexec/pyenv (3,344
bytes), renamed the new file over it, deleted /opt/homebrew/bin/pyenv
and re-created the symlink, then started a zsh shell. The malicious
pyenv ran the operator's commands and connected to an attacker server,
and Binance reports endpoint protection did not detect it. Binance
notes that the logged-in user owns /opt/homebrew, which is why none of
that needed a password.

Distinct from T0170, where the compiler or interpreter is modified so
that code the victim builds carries the attacker's changes: here the
tool is the implant and the developer's machine is the target, and
nothing reaches a build artifact. Distinct from T0154 and T0152, which
are an extension installed through a marketplace and code that runs
from project files in an IDE. Distinct from T0138, a backdoor in code
that ships to users.

Where this idea came from

Public incident / advisory

From Binance's initial findings on the 29 October 2026 theft, where code in a recruitment-assignment repository replaced pyenv under /opt/homebrew with a 3,414-byte copy, deleted the 3,344-byte original and re-created the PATH symlink, all as the logged-in user who owns the prefix. The tool runs the operator's commands whenever a shell resolves it, with no installer, no service and no new file name.

Mitigations

None linked yet.

Detections