The real problem is that you're trusting binaries you find on disparate websites.
If you want to avoid these sorts of compromises, use a package manager or check the hash of the downloaded file against one that you trust.
If you want to avoid these sorts of compromises, use a package manager or check the hash of the downloaded file against one that you trust.
Btw, we treat hash changes very seriously in homebrew-core; they are never merged without a confirmation from the upstream. Unfortunately Cask apparently doesn't live up to the same standard, but Homebrew Cask is not really Homebrew.