// Code execution / obfuscation
pattern: curl-pipe-bash
Packages whose install hook or runtime code pipes the output of a curl/wget into bash, sh, or another interpreter. Classic remote-code execution shape — fetches and runs an attacker-hosted second-stage payload.
23 packages flagged with this pattern (71 total publish events, collapsed by publisher+name). Newest first.
Autonomous CVE remediation system with AI patching, runtime validation, KinD testing, and zero-trust deployment gates.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Github action for the Infer CLI
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
RTExit - AI-assisted Red Team methodology installer
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
AgenticMail Enterprise — cloud-hosted AI agent identity, email, auth & compliance for organizations
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
The official GitHub Action for Orkestra — runs the full ork CLI surface from any workflow
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
cue — Agent Profile Manager for Claude Code & Codex. Pick a profile, launch with the right skills, MCPs, and plugins.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Project subsystem bootstrapper CLI
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
JishuShell — Raspberry Pi server management panel (Core + Web UI)
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Pinclaw Claude Code bridge — discovers local Claude Code sessions and syncs their state to Pinclaw cloud (read-only v1).
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Unified MCP pipeline for recommend-page filtering and screening on Boss Zhipin
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Engineering discipline and workflow guardrails for AI coding agents (Claude, Cursor, Codex, Gemini).
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
logging step
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Name reserved for byn — a local-first secure secrets vault & credential manager (a Go CLI). Install via `go install`, Homebrew, or https://github.com/sandeepbaynes/byn.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Desktop notifications for Claude Code, OpenAI Codex, and Gemini CLI
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Shared MetaMask agent skills installer and sync CLI.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Personal AI assistant powered by Antigravity, AI-E, Claude, Claude E, Codex, Codex App, Cursor, Gemini, Grok, OpenCode, and Copilot — Web, Terminal, Telegram, and Discord interfaces with 107 built-in skills
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Semver-oriented TypeScript library skeleton.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Iterate over ints.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Use this package to link your projects together for local development.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Kids OpenCode — a kid-safe AI coding mentor (12+). One-command install via `bun add -g @kidsinai/kids-opencode`.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
