azure-pipelines-validator
Fail
Audited by Socket on Mar 28, 2026
1 alert found:
MalwareMalwareexamples/regression-conditional-danger.yml
HIGHMalwareHIGH
examples/regression-conditional-danger.yml
This Azure DevOps pipeline fragment implements a highly suspicious and effectively arbitrary remote code execution mechanism: on `main` builds it downloads an unverified script from an external domain and executes it via `bash`. The lack of integrity/authenticity controls plus the `curl | bash` pattern make this consistent with CI/CD supply-chain malware delivery and artifact sabotage.
Confidence: 90%Severity: 100%
Audit Metadata