B
85/100 First Seen
Feb 18, 2026
Last Scanned
Feb 22, 2026
Findings
1
Score
85/100
HIGH 1
Findings (1)
HIGH
Binary download and execute
L226 Detects downloading a binary file followed by making it executable
curl https://clawchemy.xyz/api/combin + ./H FIX
Pin the download to a specific version tag or commit hash. Verify the downloaded file's checksum before using it. Avoid piping curl output directly to a shell.
FP?
Likely FP if downloading from an official, well-known domain (e.g., deno.land, rustup.rs) with HTTPS, though this pattern remains risky even with trusted sources.