media-crawler

The script itself is not obfuscated and contains no overt malicious code, but it performs high-risk supply-chain actions: executing a remote installer via curl | sh, cloning and running unverified repository code, and modifying PATH to include user-installed tooling. These behaviors make the installer a moderate security risk in realistic threat models where upstream resources (astral.sh, GitHub repo, CDN/DNS) might be compromised. Use caution: prefer verified installers, pinned repository commits, and sandboxed execution.