T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:417- Finding
Unverified Remote Scripts Are Piped Directly into Shell Interpreters
- Content
View full analysis
/dev/null; then ok "bun: v$(bun --version 2>/dev/null)" return 0 fi # Bun may be installed but not in PATH (common on WSL after fresh install) if [ -x "$HOME/.bun/bin/bun" ]; then export BUN_INSTALL="$HOME/.bun" export PATH="$BUN_INSTALL/bin:$PATH" ok "bun: v$(bun --version 2>/dev/null) (added to PATH)" else info "Installing Bun..." curl -fsSL https://bun.sh/install | bash 2>/dev/null export BUN_INSTALL="$HOME/.bun" export PATH="$BUN_INSTALL/bin:$PATH" ok "bun: v$(bun --version 2>/dev/null)" fi ``` ```sh install_uv() { if command -v uv &>/dev/null; then ok "uv: $(uv --version 2>/dev/null)" return 0 fi info "Installing uv (Python manager)..." curl -LsSf https://astral.sh/uv/install.sh | sh 2>/dev/null export PATH="$HOME/.local/bin:$PATH" ok "uv: $(uv --version 2>/dev/null)" } ``` ### Technical Analysis The installer downloads mutable content from `bun.sh` and `astral.sh` and immediately passes it to `bash` or `sh`. No pinned version, cryptographic signature, independently trusted checksum, or local inspection is used before execution. HTTPS protects the transport connection but does not protect against compromise of the upstream website, CDN, DNS infrastructure, release account, or the remote script itself. The effective code executed by the audited project can therefore change after the project has been reviewed. Installing Bun and uv supports the declared backend functionality, but executing mutable remote shell scripts is not the minimum privilege or minimum-risk mechanism needed to install those dependencies. ### Attack Path 1. An attacker compromises an upstream domain, ...[truncated 989 chars]- Remediation
View remediation
/dev/null`. ]]>