With the now current curl | sh pattern, one just needs some MTM attack, or even just trick someone to do it, as the majority never look to the contents of the shell script.

Which is why it could only be done in a vm. VM breakout is still a risk but at the end of the day it's only ever about mitigation not panacea. A startling number of people use this method too what with the plethora of package managers available. The evildoer's best friend laziness - just keeping going longer than someone on average would reasonably expect you to, i.e. not very.

It's been demonstrated in the past that server can detect the pipe to shell and modify content - timing attack, if I recall correctly

How does it work? Any sources?

Thanks, that's very interesting.

Or serve a different script based on browser headers.

Out just develop a really useful node script that then gets a little extra.

I've been worrying about this for some time, I regularly get customers sending screenshots inside Word documents, a well targeted email could easily get past my defences.