What is the difference between the two urls?
one has an @ and one doesn't.
But also the first downloads version 15 of postgres from GitHub and the second one resolves to v15 dot zip domain which can also downloads a zip file that sure doesn't have postgres in it.
You see, URLs with @ in them are split into two parts, anything before @ is user info and anything after it is the host name, however this rule is broken if what comes before @ are forward slashes.
The second URL includes a character encoded like forward slash but isn't really the real forward slash, which URL parsers ignores making anything before the @ as user info and treating whatever comes after it as the real hostname.
While this can happen on any domain, the zip domains makes it more likely to happen. When you click on a link that ends in zip especially if it looks like from GitHub you won't think twice about it.
Read the full blog from Bobbyr below.