Have there been any notable incidents where mistrusting a curl | sh was the cause? I hear people say not to do it way more than I hear people talking about actual incidents it's caused.
I've had a few. Not as security attacks.
More just very badly made install scripts, which (in good faith) destroy some part of my operating system.
Messing up repositories added to package manager, creating dependency conflicts, overwriting config files I used. Even removing full folders - "because it's MINE" syndrome. --dry-run modes that are destructive. A lot of install scripts treat my computer as disposable machine meant for their app only.
Technically any app installer can do this. Happens all the time on Windows actually with ms store apps
One coverage tracker used something like this for recommended CI setup, script was hijacked, users were advised to rotate all credentials available in CI.
None. It was always a kind of snobbery against packages too small to be in package managers.
There are reasons curl|sh is a bad way to install things but security isn't one. It's difficult to uninstall, for instance.
I mean you really don't wanna run this one
echo -e "HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\nrm /" | nc -l 8080 & curl localhost:8080 | sh
it'll just print an error message because / is a directory. There's also a good chance curl starts first and fails to connect to the server that's not running yet.