For those saying curl | sh isn't that bad, remember that the codecov script was breached, and attackers used it to upload environment variables containing secre

For those saying curl | sh isn't that bad, remember that the codecov script was breached, and attackers used it to upload environment variables containing secrets, and it took months to get noticed [1]. If they had provided a versioned URL and checksum validation as part of their copy & paste snippet, the breach would have been noticed right away. [1] https://www.reuters.com/technology/codecov-hackers-breached-hundreds-restricted-customer-sites-sources-2021-04-19/ https://www.reuters.com/technology/codecov-hackers-breached-...