Comment by leokennis

Not that it would fix anything, but wouldn't it be possible to:

- Store the install script on www.xyz.com/install.sh

- Store the hash of the install script on www.abc.com/hash.dat

Then in the installation command:

- curl the install script from www.xyz.com/install.sh

- hash it

- curl the hash from www.abc.com/hash.dat

- compare the computed hash with the "curl'd hash"

- only if they match, pipe www.xyz.com/install.sh to bash

In that case, a malicious actor would need to hack at least two locations to be successful.