“Instead, HiCA is stealthily crafting curl commands and piping the output to bash.”
HiCA, a certificate seller that only supports acme.sh, hid a base64-obfuscated curl command inside the challenge token. acme.sh fed it through eval and ran it. Aleksejs Popovs pulled the remote script and confirmed it executes. A certificate client that evals strings from the server is a remote shell with extra steps, and a CA found it first.