Yeah I am not a fan of curl bash either, but installing via most package managers (brew, npm etc) isn’t much better, since most of these skip sandboxing rn.

Maybe I am missing something, but the second you run the code, it has the same powers and risk profile as a bash curled from the internet. Maybe something about having explicit versioning?

(as an aside, I think this will change very soon…)