coolify-ops
Warn
Audited by Socket on Jun 25, 2026
1 alert found:
AnomalyAnomalyscripts/install-cli.sh
LOWAnomalyLOW
scripts/install-cli.sh
This wrapper is primarily an installer/launcher and shows no direct malicious logic (no credential theft or exfiltration in the snippet). The main security concern is supply-chain risk: it executes a remote GitHub-hosted shell script via `curl ... | bash` without checksum/signature verification and it optionally installs using a moving target (`coolify@latest`). These patterns should be treated as high-integrity requirements for trusted environments; review and pin/verify upstream artifacts when possible.
Confidence: 70%Severity: 65%
Audit Metadata