It's a Python script. It's also available via Homebrew, but is curl download any worse than Homebrew or npm install?

(Obviously curl download piped into "sh" or similar is pretty terrible, but at the end of the day, there's a ton of software out there being installed via trust alone)