“In the Homebrew/homebrew-cask repository, it was possible to merge the malicious pull request by confusing the library that is used in the automated pull request review script developed by the Homebrew project.”
Homebrew auto-merged cask pull requests if a script decided the diff only bumped a version or checksum. A crafted diff fooled the parser, and a malicious change got approved and merged. Anyone who installed that cask next would have run the attacker’s code. A package manager that installs code as you is only as safe as its least careful script.