[oholiab]

It's actually possible to detect the |bash part server side and send different content than if you were simply curling, wgeting or viewing in a browser.

Not only does this mean that you could end up with a compromised system, but it also means that there's no artefact of what caused it left on disk.

I agree with your point that running third party software is always a risk, the problem here being that you can think you've done your due diligence by reading the curl output first and then doing curl|bash, but in actuality this is not necessarily the case which is what makes curl|bash such an insidious bad habit.

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

[ricardobeat]

Does anyone read install scripts/formulas when installing something from system package managers?

[bluecmd]

No, but I trust my OS distribution. I don't trust random third-party developer. I wouldn't add their APT repository willy nilly either.

[semi-extrinsic]

On Arch, installing from AUR people are told to (and generally will) inspect the install script(s) when installing something. It's part of the workflow for all AUR helpers.