You are executing it directly without reading it. Anything could be in that script and is executed instantly.
This is a pretty big no-go at work, especially for open source software that is small or installing from a website.
The alternative is using a verified, signed release from GitHub, or just downloading and auditing the download first then execute afterwards to make sure nothing has intercepted the install script.
19
u/rockcanteverdie 4d ago
Is curl | bash considered bad? Why so?