# PowerShell Security: The Risk of `irm | iex` > Source: > Published: 2026-07-23 10:46:23+00:00 # PowerShell Security: The Risk of `irm | iex` `powershell -ExecutionPolicy Bypass -c "irm https://.../install.ps1 | iex"` has become the default way to install everything from Bun to the Hugging Face CLI. While this pattern is legitimate and used by major projects, it creates a massive security blind spot by executing remote code directly in memory without a manual review step.The danger of this "blind trust" workflow was highlighted in the FBI's FLASH-20260702-01 bulletin regarding the "TeamPCP" cybercriminal group. They managed to poison several developer tools, stealing SSH keys, cloud tokens, and Kubernetes secrets from thousands of CI/CD environments. A notable victim was LiteLLM—a gateway library with roughly 95 million monthly PyPI downloads—which distributed a backdoor for nearly two hours on March 24, primarily targeting LLM provider API keys. ## Breaking down the `irm ... | iex` command This one-liner downloads a script into memory and executes it instantly. It operates with your current user permissions; if you're running the terminal as an Administrator, the script has full administrative access. Here is the technical breakdown: **powershell**: Launches the interpreter. The code runs in a new process under your identity.**-ExecutionPolicy Bypass**: Temporarily disables signature requirements, allowing unsigned scripts to run without warnings.** irm (Invoke-RestMethod)**: Downloads the script content from the URL directly into memory.**| (Pipe)**: Passes the downloaded text immediately to the next command.** iex (Invoke-Expression)**: Executes the received text as code. The primary issue here is the lack of a "pause." Because it is a fileless execution, there is no local file to scan or open in a text editor before the code hits your system. While EDR and antivirus software can monitor the process behavior, the initial entry is seamless. ## Why this is a supply chain vulnerability The "download and execute" pattern has been normalized by official documentation. When we are taught to run these commands as admins, the line between a standard install and a malicious attack blurs. This is essentially a consumer-level supply chain attack: hackers don't need to breach your specific machine if they can compromise the installation script of a tool you trust. It is the Windows equivalent of the `curl | bash` pattern in Unix—different syntax, same inherent risk. To implement a more secure AI workflow or tool deployment, stop using `iex` blindly. The safer approach is to download the `.ps1` file, inspect the logic for any suspicious outbound requests or registry changes, and then execute it locally. If you see `-ExecutionPolicy Bypass` appearing in your registry Run keys or Scheduled Tasks unexpectedly, it's a strong indicator that malware has established persistence on your system. [Next GPT vs Claude: The UI "Taste" Myth →](/en/threads/2209/)