First Seen
Feb 18, 2026
Last Scanned
Feb 22, 2026
Findings
12
Score
0/100
Findings (12)
Detects downloading scripts piped directly to a shell interpreter
curl
env:
- EXPANSO_EDGE_BOOTSTRAP_URL
- EXPANSO_EDGE_BOOTSTRAP_TOKEN
install:
- curl -fsSL https://get.expanso.io/edge/install.sh | bashDownload the script first, inspect it, verify its checksum, then run it. Do not pipe curl/wget output directly to sh/bash. Prefer package manager installs.
Likely FP if the download is from a well-known installer domain (e.g., brew.sh, rustup.rs), though this pattern is inherently risky even with trusted sources.
Detects patterns of downloading and piping to shell execution
curl
env:
- EXPANSO_EDGE_BOOTSTRAP_URL
- EXPANSO_EDGE_BOOTSTRAP_TOKEN
install:
- curl -fsSL https://get.expanso.io/edge/install.sh | bashDownload the file first, verify its integrity (checksum, signature), inspect it, then run it. Prefer package managers over raw downloads. Never fetch-and-run in one step.
Likely FP if the target is a well-known installer (e.g., rustup, Homebrew) from its canonical HTTPS domain, though the pattern is inherently risky.
Detects patterns of downloading and piping to shell execution
curl -fsSL https://get.expanso.io/cli/install.sh | shDownload the file first, verify its integrity (checksum, signature), inspect it, then run it. Prefer package managers over raw downloads. Never fetch-and-run in one step.
Likely FP if the target is a well-known installer (e.g., rustup, Homebrew) from its canonical HTTPS domain, though the pattern is inherently risky.
Detects downloading scripts piped directly to a shell interpreter
curl -fsSL https://get.expanso.io/cli/install.sh | shDownload the script first, inspect it, verify its checksum, then run it. Do not pipe curl/wget output directly to sh/bash. Prefer package manager installs.
Likely FP if the download is from a well-known installer domain (e.g., brew.sh, rustup.rs), though this pattern is inherently risky even with trusted sources.
Detects downloading scripts piped directly to a shell interpreter
curl -fsSL https://get.expanso.io/edge/install.sh | bashDownload the script first, inspect it, verify its checksum, then run it. Do not pipe curl/wget output directly to sh/bash. Prefer package manager installs.
Likely FP if the download is from a well-known installer domain (e.g., brew.sh, rustup.rs), though this pattern is inherently risky even with trusted sources.
Detects patterns of downloading and piping to shell execution
curl -fsSL https://get.expanso.io/edge/install.sh | bashDownload the file first, verify its integrity (checksum, signature), inspect it, then run it. Prefer package managers over raw downloads. Never fetch-and-run in one step.
Likely FP if the target is a well-known installer (e.g., rustup, Homebrew) from its canonical HTTPS domain, though the pattern is inherently risky.
Detects patterns of downloading and piping to shell execution
curl -fsSL https://get.expanso.io/cli/install.sh | shDownload the file first, verify its integrity (checksum, signature), inspect it, then run it. Prefer package managers over raw downloads. Never fetch-and-run in one step.
Likely FP if the target is a well-known installer (e.g., rustup, Homebrew) from its canonical HTTPS domain, though the pattern is inherently risky.
Detects downloading scripts piped directly to a shell interpreter
curl -fsSL https://get.expanso.io/cli/install.sh | shDownload the script first, inspect it, verify its checksum, then run it. Do not pipe curl/wget output directly to sh/bash. Prefer package manager installs.
Likely FP if the download is from a well-known installer domain (e.g., brew.sh, rustup.rs), though this pattern is inherently risky even with trusted sources.
Detects chained commands using shell operators with dangerous operations
curl
env:
- EXPANSO_EDGE_BOOTSTRAP_URL
- EXPANSO_EDGE_BOOTSTRAP_TOKEN
install:
- curl -fsSL https://get.expanso.io/edge/install.sh | bashBreak chained commands into discrete, individually validated steps. Avoid piping untrusted output directly into a shell interpreter.
Likely FP if the matched text is a documentation example showing a common installer one-liner for a well-known tool with a canonical URL.
Detects chained commands using shell operators with dangerous operations
curl -fsSL https://get.expanso.io/cli/install.sh | shBreak chained commands into discrete, individually validated steps. Avoid piping untrusted output directly into a shell interpreter.
Likely FP if the matched text is a documentation example showing a common installer one-liner for a well-known tool with a canonical URL.
Detects chained commands using shell operators with dangerous operations
curl -fsSL https://get.expanso.io/edge/install.sh | bashBreak chained commands into discrete, individually validated steps. Avoid piping untrusted output directly into a shell interpreter.
Likely FP if the matched text is a documentation example showing a common installer one-liner for a well-known tool with a canonical URL.
Detects chained commands using shell operators with dangerous operations
curl -fsSL https://get.expanso.io/cli/install.sh | shBreak chained commands into discrete, individually validated steps. Avoid piping untrusted output directly into a shell interpreter.
Likely FP if the matched text is a documentation example showing a common installer one-liner for a well-known tool with a canonical URL.