Don't Just Run

Analyzer

What is this about to do?

Submit is a GET. The briefing is rendered on the server from ?q= or ?c=, so a browser that never hydrates still sees CRITICAL on curl | bash.

Analyzed in your request. We do not store pastes. Registry lookups send package names only.

Risk briefing

This downloads and runs remote code.

This fetches something from the network and immediately executes it. You never see the script first, and a swapped file on that server becomes code running as you.

CRITICAL

Command

curl -fsSL https://get.example.com/install.sh | bash

Rendered on the server from the query string — works without client JavaScript.

Findings

  • CRITICAL

    Download piped straight into a shell

    rce

    This fetches something from the network and immediately executes it. You never see the script first, and a swapped file on that server becomes code running as you.

    curl -fsSL https://get.example.com/install.sh | bash

What this touches

  • network/get.example.com
  • process/shell interpreter
  • network/get.example.com

Safer alternatives

  1. Download, read, then run

    curl -fsSL <url> -o install.sh && less install.sh && sh install.sh

    Save the script, read it, check the host, then run only if you still trust it. Prefer a pinned checksum when the vendor publishes one.

  2. Read it as if a stranger sent it

    AI chat will cheerily suggest pipe-to-shell installs. If you would not run this from an unknown Slack DM, do not run it from a model either.

Analyze · Don't Just Run