Don't Just Run

Analyzer

What is this about to do?

Submit is a GET. The briefing is rendered on the server from ?q= or ?c=, so a browser that never hydrates still sees CRITICAL on curl | bash.

Analyzed in your request. We do not store pastes. Registry lookups send package names only.

Risk briefing

Nothing obviously dangerous.

Don't Just Run’s rules did not see remote execution, destructive wipes, secret theft, or a missing package. Still read the command — rules miss things.

SAFE

Command

npm install express

Rendered on the server from the query string — works without client JavaScript.

What this touches

  • package/npm:express

Packages

NameRegistryVersionLookup
expressnpm—found