If you are looking to download an installation bundle for VMware ESXi (Hypervisor) or vCenter Server (VCSA), you do not use a command line tool called vmx-bundle. Instead, you download the bundle manually.
Steps:
Before analyzing risks, it is important to acknowledge legitimate scenarios: vmx-bundle download
In all these cases, the download is controlled, checksum-verified, and originates from a trusted source. If you are looking to download an installation
Most enterprise software requires you to download the bundle from the official vendor portal. Log In: