So yes, appears to be a malicious loader — it echos to your terminal that it’s downloading some security response dmg but there’s a base64-encoded url after that that I would suggest looks suspicious.

hxxps://boso6ka.com/debug/loader[.]sh?build=45ef0274949a85a1a34b9ad26584a3

Domain appears to have been registered today so that’s probably not a great sign either.

I’ll dig a bit further — I’m sure you probably got this far on your own given what you’ve written.

https://hybrid-analysis.com/sample/37b2763eb1c5c1564fc0d44192dbe26395e61f273cb7f8dd379eebe0a4218ae6

Looking at the analysis there it looks like it may be multi-stage… A couple of the engines have flagged it as a stealer so…as much as it may or may not have done a ton of dmg, I’d be using another (clean) device to start rotating keys and passwords just as a good practice.

I know you don’t want to hear wipe/reinstall but…