Supply chain attacks are running more and more rampant, a common vector for those are services that use URL shorteners to point back to their official repositories or download links.
These are especially effective at targeting developers who often trust commands that they are given from official repos.
It is impossible to validate that a shortened URL is not malicious unless you follow investigate it yourself. This is even more dangerous when it's expected to be blindly ran in a command line environment. Increasing the risk of supply chain vulnerabilities either in repo, or in forks/look-alikes.
Additionally there's high propensity of link shortening services to inject their own assets into shortened links as they try and aggressively monetize. Putting users of this at risk in their most vulnerable location (Their router).
Links back to install scripts should link directly to the source, not to an unknown third party.
Supply chain attacks are running more and more rampant, a common vector for those are services that use URL shorteners to point back to their official repositories or download links.
These are especially effective at targeting developers who often trust commands that they are given from official repos.
It is impossible to validate that a shortened URL is not malicious unless you follow investigate it yourself. This is even more dangerous when it's expected to be blindly ran in a command line environment. Increasing the risk of supply chain vulnerabilities either in repo, or in forks/look-alikes.
Additionally there's high propensity of link shortening services to inject their own assets into shortened links as they try and aggressively monetize. Putting users of this at risk in their most vulnerable location (Their router).
Links back to install scripts should link directly to the source, not to an unknown third party.