I've never downloaded through the terminal if I can help it. And I just realized that my method for downloading software that has even a remote chance of containing EVIL THINGS is, well, maybe a tad paranoid.
So, first I download the software onto a NAS. Then, I put it on a thumb drive and put that in what I call my "black" computer. It's basically a computer that has no access to any internet, or my other computers.
Next, I download and open the software on the black computer. If it runs fine, meaning no glitches or weird shenanigans, then I'll take the thumb drive and upload the software to my regular computer.
Is this weird? I just realized for the first time in about 12 years that it might be indicative that maybe I've watched Enemy of the State 8 too many times...
I've always routinely pasted any command I've copied into Notepad first, then highlighted and copied the command again from Notepad before pasting the command anywhere else.
That simple extra step ensures the exploit can't be used on any command I ever copy from a webpage, regardless of any hidden scripts that could exist.
I find it simple because when I press Windows + R on my system, Notepad is always the last command I've run there. So the entire process takes two or three seconds at most with the following keyboard shortcuts...
Windows+R, Enter (Opens Notepad)
Ctrl-V (Pastes clipboard content into Notepad)
Ctrl-A (Highlight all pasted content)
Ctrl-X (Cut content back into the clipboard)
Alt-F4 (Closes Notepad)
...and I'm ready to safely paste to wherever I like without any form of formatting or hidden script content.
Of course, if I noted anything in Notepad that shouldn't be there after pasting, I would stop at that point and suss out what's going on.
Been doing that as a matter of routine for years now so it's become second nature for me.
FWIW, this attack can be trivially prevented in two ways:
1. Major shells (e.g. zsh, fish, bash via an option) support bracketed paste, which allows a compatible terminal to signal the beginning and end of pasted text via escape sequences. This lets you paste stuff into your shell and trust that it will wait for you to hit Enter before executing it.
Anytime I've done any console work that have been using commands I've run across on the 'net I've always manually typed the command(s). Doing that gets my brain engaged in whatever system/admin stuff I'm trying to do.
Easy to deal with a mistyped command so I know my fat fingers were at fault. Frustrating, but not as bad as a command that basically says "blow up your OS, sucker!"
The history of the IBM PC, with the originally planned O/S2 operating system. The OS that MS had a hand in creating and sabotaging so MS-DOS became the marketing department's "gotta ship this" alternative. The OS that MS only licensed because the marketing department believed it was a better deal for customers so every IBM PC price a good chunk of it went to MS.
IBM-PCs became the de-facto PC standard, because of the reputation IBM had for their main-frames.
MS-DOS, which was a blatant theft by MS the original developer couldn't afford to fight.
NT was another "freeze out" the original developer situation.