:() { :|: & };:

It’s a fork bomb.

In computing, the fork bomb is a form of denial-of-service attack against a computer system which makes use of the fork operation (or equivalent functionality) whereby a running process can create another running process. Fork bombs typically do not spread as worms or viruses; to incapacitate a system, they rely on the (generally valid) assumption that the number of programs and processes which may execute simultaneously on a computer has a limit. This type of self-replicating program is sometimes called a wabbit.

Wikipedia: Fork Bomb

Borrowing a better explanation in a StackOverflow question‘s answer:

Breaking it down, there are three big pieces:

Inside the body, the function is invoked twice and the pipeline is backgrounded; each successive invocation on the processes spawns even more calls to “:”. This leads rapidly to an explosive consumption in system resources, grinding things to a halt.

Note that invoking it once, infinitely recursing, wouldn’t be good enough, since that would just lead to a stack overflow on the original process, which is messy but can be dealt with.

A more human-friendly version looks like this:

John Feminella‘s answer on Fork Bombs

Other legal variants include:

• :(){ :|: & };:
• :() { :|: & };:
• :(){:|:&};:
• :() { :|:& };: