I understand your point, but there is a big difference between running a 20 year old program written in C and running a shell script that someone with one or two years of experience hacked out in ten minutes. To answer your question, I do fuzz many of the GNU utilities that I use regularly, and I have discovered vulnerabilities that way. Of course it is unreasonable to read all of the code that runs in our operating systems, but it is not unreasonable to read shell scripts before you run them.
Plus the risk associated with running Linux or any of the executables is orders of magnitude lower than copy/pasting and running a bash script one found on the internet.
Comments
I understand your point, but there is a big difference between running a 20 year old program written in C and running a shell script that someone with one or two years of experience hacked out in ten minutes. To answer your question, I do fuzz many of the GNU utilities that I use regularly, and I have discovered vulnerabilities that way. Of course it is unreasonable to read all of the code that runs in our operating systems, but it is not unreasonable to read shell scripts before you run them.
Plus the risk associated with running Linux or any of the executables is orders of magnitude lower than copy/pasting and running a bash script one found on the internet.
The same can't be said for npm packages and people still use them.