Bashka – static analyzer for bash install scripts (for safety and convenience) Developer dmtrKovalenko released Bashka, a static analyzer that inspects scripts run through the `curl … | bash` install pattern and scores them against more than 20 checks across four severity levels: 💀 critical, 🚩 red, 🟡 yellow, and ✅ green. Bashka follows forwarded scripts so every layer is analyzed, and flags issues including credential theft, exfiltration, reverse shells, obfuscation, and insecure TLS while rewarding good-citizen signals such as checksum verification and `set -euo pipefail`. The tool is installed via `curl --proto '=https' --tlsv1.2 -fsSL https://bashka.dmtrkovalenko.dev | bash` and is used by appending `bashka` in place of `bash` in an existing install command. A drop-in safety guard for the curl … | bash install pattern. Bashka parses the incoming script, scores it against many different checks, follows forwarded scripts so every layer is analyzed and if it found some unsafety it gives you an easy way to read a script or analyze using your AI agent. Useage is simple as adding ka after the standard installation script curl -fsSL https://pyenv.run | bashka bashka.mp4 Install via bash. One last time. curl --proto '=https' --tlsv1.2 -fsSL https://bashka.dmtrkovalenko.dev | bash We guarantee absolute safety of this script Read it yourself https://raw.githubusercontent.com/dmtrKovalenko/bashka/main/install.sh Findings come in four kinds: 💀 💀 critically malicious, blocks hard , 🚩 red dangerous , 🟡 yellow advisory, never changes the verdict , ✅ green good-citizen signal . | kind | id | what it looks for | |---|---|---| | 💀 | exfil destination | sends data to webhook.site/Discord/Telegram/ngrok/paste sites, the cloud-metadata IP, or a raw IP Codecov, Shai-Hulud | | 💀 | credential theft | reads SSH keys, cloud credentials, .netrc , the keychain | | 💀 | exfiltration | environment or secrets sent to the network env \| curl , curl -d "$TOKEN" | | 💀 | reverse shell | backdoors: /dev/tcp , nc -e , socat EXEC , mkfifo pipe-to-shell | | 🟢 | checksum | download digest checked: sha256sum -c , $ shasum … compared, openssl dgst | | 🟢 | cleanup artifacts | trap … EXIT , or rm of a mktemp path | | 🟢 | https only | every download URL uses HTTPS | | 🟢 | install dir | installs into /usr/local/bin or ~/.local/bin | | 🟢 | privilege escalation | 🟢 never escalates; 🟡 uses sudo / doas . Some scripts genuinly need sudo and you will be prompted for it. | | 🟢 | strict mode | set -euo pipefail | | 🟢 | tls hardening | curl pins HTTPS-only and TLS 1.2+ --proto '=https' --tlsv1.2 | | 🟢 | trusted domains | HTTPS downloads from GitHub, or the same domain the script was fetched from | | 🟢 | verify | signature verified: gpg --verify , cosign , minisign , openssl dgst -verify | | 🔴 | anti forensics | hides tracks: HISTFILE=/dev/null , history -c , log truncation, journalctl --vacuum , killing EDR/audit agents | | 🔴 | banned commands | rm -rf / , dd of=/dev/ , mkfs , fork bomb, chmod -R 777 | | 🔴 | domain refs | plaintext HTTP, raw-IP hosts, URL shorteners | | 🔴 | env hijack | hijacks auto-run hooks: BASH ENV / PROMPT COMMAND / LD PRELOAD / NODE OPTIONS --require , sitecustomize.py | | 🔴 | git hooks | repoints git execution: core.hooksPath , core.fsmonitor , alias.x ' cmd' , or writes into .git/hooks | | 🔴 | insecure tls | certificate checks off: curl -k , --no-check-certificate , GIT SSL NO VERIFY | | 🔴 | install name | downloads files but nothing names the software no URL hint, product variable, GitHub repo or bin target ; yellow when the script takes the project from its arguments | | 🔴 | install target | downloads files but never names where they are installed | | 🔴 | macos bypass | strips Gatekeeper quarantine xattr … com.apple.quarantine , tampers with TCC; osascript … hidden answer password phish is 💀 | | 🔴 | max commands | more commands than limit | | 🔴 | not a script | the body is an HTTP redirect stub, an HTML/JSON page, or has no recognizable command fetch with curl -fsSL | | 🔴 | obfuscation | eval of opaque code eval "$CMD" , eval $ … , decode-then-execute pipelines | | 🔴 | package managers | pulls code from npm/npx/pip/cargo/go/gem/brew/docker or editor extensions; 🔴 on URL/git/mutable ref/foreign registry/ --privileged , yellow on a plain global install | | 🔴 | path suspicious | PATH gains a temp, relative or world-writable directory | | 🔴 | remote exec | fetch- exec forward sinks drives chain following | | 🔴 | scheduled tasks | schedules code via cron, at , systemd timers, autostart or rc.local | | 🔴 | security tampering | disables firewall/SELinux/AppArmor/Gatekeeper/SIP | | 🔴 | self extract | reads its own bytes $0 with sed/tail/dd/base64 and pipes the result into a shell | | 🔴 | sensitive write | writes to shell rc files, ~/.ssh , /etc/sudoers , crontab | | 🔴 | staged installer | downloads a program and runs it to do the install; the second stage is opaque to review | | 🔴 | unicode tricks | invisible, bidi, or homoglyph characters in a command name or URL, or a punycode host | | 🔴 | unsafe rm | rm -rf "$VAR/" where the variable may be empty and there is no guard or set -u | | 🔴 | upload exfil | uploads files curl -T , -F @file , --data @file , copies out via scp/rsync, or DNS-exfil via dig $ … | | 🟡 | checksum | green if checks a digest, yellow if downloads are unverified | | 🟡 | many downloads | fetches from more than limit distinct URLs default 2 | | 🟡 | mutable refs | downloads from master / main / HEAD / latest instead of a pinned version | | 🟡 | package repos | adds apt/yum/zypper repositories or signing keys | | 🟡 | persistence | installs systemd/launchd services or init scripts | | 🟡 | telemetry | sends data out POST / --data , or analytics URLs | Some of the additional commands bashka list --long table of software installed through bashka bashka info