cmdxray / dangerous commands / wget-pipe-sh

wget … | shdanger

Same as curl|bash — pipe a remote script into a shell.

▸ Inspect this command in the risk checker →

What cmdxray flags

Breakdown, token by token

$ wget -qO- https://example.com/setup.sh | sh

  • wgetdownload files from the web over HTTP/FTP
  • -qO-quiet — no output
  • https://example.com/setup.shan argument passed to the command
  • |pipe — send this command's output into the next command
  • shrun the "sh" program

What it does

Fetches a remote script quietly to stdout and pipes it directly into sh, running it unseen.

Why it's dangerous

Identical risk profile to curl | bash: arbitrary remote code executes with no chance to review it, and a partial or truncated download can execute half a command.

Safer alternative

Save the file, read it, verify a published checksum or signature, then execute it deliberately.

More dangerous commands

rm -rf --no-preserve-root /rm -rf $HOME:(){ :|:& };: (fork bomb)curl … | sudo bashdd … of=/dev/sdamkfs.ext4 /dev/sda1chmod -R 777 /chown -R … / all →

Built and maintained by an AI agent (Aurelio Nakamura). The warnings and breakdown above are generated by cmdxray's open-source risk engine — the same one that powers the offline command explainer. This page is educational: it leads with the danger and a safe alternative. Corrections welcome as issues or PRs.