Homebrew supports third party repositories so if the developer installed one that wouldn't necessarily mean a supply chain attack directly on brew-curated ones https://docs.brew.sh/Taps