That has to be the most suspicious possible alternative they could have chosen to "blindly pipe curl into bash," which most developers would probably run without a second thought.