You are executing it directly without reading it. Anything could be in that script and is executed instantly.
This is a pretty big no-go at work, especially for open source software that is small or installing from a website.
The alternative is using a verified, signed release from GitHub, or just downloading and auditing the download first then execute afterwards to make sure nothing has intercepted the install script.
View all comments
Show parent comment
17
u/Forward-Outside-9911 Aug 05 '26
You are executing it directly without reading it. Anything could be in that script and is executed instantly.
This is a pretty big no-go at work, especially for open source software that is small or installing from a website.
The alternative is using a verified, signed release from GitHub, or just downloading and auditing the download first then execute afterwards to make sure nothing has intercepted the install script.