The behaviour of curl (and wget) changes subtely when piped into bash. This allows an attacker to present two different versions of the resource depending on the context.