Um... Security risk much?

While cruising through the Internet a few minute ago, I wandered across Meteor [1],
which looks like a really cool tool/system/platform/whatever for building modern web
applications. JavaScript on the front, JavaScript on the back, Mongo backing, it's
definitely something worth looking into, IMHO.

Thus emboldened, I decide to look at how to start playing with it, and lo and behold
I discover that the instructions for installation are:
curl https://install.meteor.com [2] | sh

Um.... Wat?>

Now, I'm sure the Meteor folks are all nice people, and they're making sure (via the
use of the https URL) that whatever is piped into my shell is, in fact, coming from
their servers, but I don't know these people from Adam or Eve, and that's taking an
awfully big risk on my part, just letting them pipe whatever-the-hell-they-want into
a shell Terminal. Hell, you don't even need root access to fill my hard drive with
whatever random bits of goo you wanted.

I looked at the shell script, and it's all OK, mind you--the Meteor people definitely
look trustworthy, I want to reassure anyone of that. But I'm really, really hoping
that this is NOT their preferred mechanism for delivery... nor is it anyone's preferred
mechanism for delivery... because that's got a gaping security hole in it about twelve
miles wide. It's just begging for some random evil hacker to post a website saying,
"Hey, all, I've got his really cool framework y'all should try..." and bury the malware
inside the code somewhere.

Which leads to today's Random Thought Experiment of the Day: How long would it take
the open source community to discover malware buried inside of an open-source package,
particularly one that's in widespread use, a la Apache or Tomcat or JBoss? (Assume
all the core committers were in on it--how many people, aside from the core committers,
actually look at the source of the packages we download and install, sometimes under
root permissions?)

Not saying we should abandon open source; just saying we should be responsible citizens
about who we let in our front door.

UPDATE: Having done the install, I realize that it's a two-step download...
the shell script just figures out which OS you're on, which tool (curl or wget) to
use, and asks you for root access to download and install the actual distribution.
Which, honestly, I didn't look at. So, here's hoping the Meteor folks are as good
as I'm assuming them to be....

Still highlights that this is a huge security risk.

Enterprise consulting, mentoring or instruction. Java, C++, .NET or XML services.
1-day or multi-day workshops available. Contact
me for details [3].