gate-exchange-earn

The code is a conventional release installer with no clear malicious behavior in the supplied shell script. Its main security concern is artifact trust: checksum verification is optional, and when performed the checksum file is obtained from the same unpinned GitHub release source as the archive, without a signature or trusted checksum embedded in the installer. A compromised release repository, GitHub artifact, or unavailable checksum utility could therefore result in installation of a malicious binary, including via sudo. The explicit --version value is quoted and does not present an evident command-injection path.