Websites can append to your clipboard
The risk is exactly what you said it was. It's definitely possible to append malicious commands to the clipboard.
You could even append
&& rm -rf /* (only executes if the first command was successful), or
; rm -rf /* (executes even if the first command was unsuccessful) and brick certain UEFI devices.
You should also check out Michael's post in this thread for another example.
In the end, it really depends on how creative and malicious a particular evil "hacker" is.
But how can you make the commands "invisible" in the terminal?"
echo test;echo insert evil here;clear;echo installing package
- Echo "test" happens
- Echo "insert evil here" happens
- Actions are "cleared"
- Intended action happens here, but you don't see the rest.
You can try to scroll up in the terminal window to find the rest of it.
This will disable the terminal from showing what you're typing, so it doesn't appear in the terminal window at all.
You can try it like this:
stty -echo;tput smcup;echo evil commands
Those are just two really rough examples, but show the potential of what can be done to obfuscate commands. Note that it likely doesn't hide from ~/.bash_history unless the hidden commands specifically delete/modify it's contents.
You should assume that there are other ways to do this.
I recommend using an addon to disable clipboard manipulation. There are unfortunately ways to get around that, so I'd recommend pasting everything into a text editor before it goes into your terminal, or anywhere.
You need to verify what you're doing. If you don't understand each individual command, you should google it. This is proper tinfoil hattery because copy and pasting can force the commands to auto-execute on many Linux flavors.
Repairing your Linux installation
You might not have any idea how deep the rabbit hole goes. Unless you have the time and effort to put into it, I'd suggest you just nuke from orbit, unless you have important files. If you have important files, just back up the non-executable stuff (no pdfs, documents, etc), and then nuke from orbit.
If you have PDFs, you can convert the PDF to post-script, or copy and paste the contents into a text file. With documents, copy and paste the text and format it later.