Vagrant has a dependency on libffi (/opt/vagrant/embedded/lib/libffi.dylib). This appears to be libffi 3.2.1 (/opt/vagrant/embedded/lib/libffi-3.2.1/). My works security software (Cylance) keeps quarantining libffi on my mac. I’m guessing this is most likely because there’s been reported critical vulnerability in this version of libffi - https://nvd.nist.gov/vuln/detail/CVE-2017-1000376 (although mac is not on the known configuration list, and it’s not clear that this CVE applies at all on mac).