A neat attack, but probably unrealistic in the context of those downloads being on github.
Not really that simple. All the scripts there curl|bash more scripts. If you want to audit the contents you’ll have to follow quite a few.
yes, I had a better look at not trivial ones, and you are all correct
Its not just one script that you're curling and execing. That scripts curls and execs some other scripts. And those others. You're pretty much auditing a whole codebase at that point, for better or worse.