Oh the example in the article is the nice version if this attack.

Checking the script as downloaded by wget or curl and the piping curl to bash is still a terrible idea, as you have no guarantee you’ll get the same script in both cases:

• Detecting the use of “curl | bash” server side
• Recent implementation of this attack