> In deployment scripts: > > wget -qO- https://raw.githubusercontent.com/xthezealot/npmprune/master... | sh -- -p Serious question: Is this the norm now? Are people actually executing unversioned wget'd shell scripts from random github users as part of their deployment workflow?
The threat model is exactly the same as executing untrusted, uninspected content you've downloaded locally. I could do some tricks where I sent different files based on user agent, but still... most people aren't inspecting the download anyway before running it.
https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
I'm on mobile and this refuses to load due to SSL/HSTS problems. It's an interesting approach if you can get it to load.
Point being... someone clever could make a bad day for the minority of users who do check first (but don't save/run what they explicitly checked)
Running curl, saying "yup that looks good", then adding a pipe achieves little with actual malice. The payload can be completely hidden until it's too late
The phrasing you use is important for any hope at safety - review/run the same downloaded thing.