I'm pretty sure that's like Piracy
That program will not work without legit installing Terraria.
Steam will obviously not allow anyone to just download any game: you need to have permission to do so. You obtain that permission by having a steam account, and of course paying the price for a non-free game like this. Thus, that "depot downloader" needs your steam account to authenticate, by just asking you to enter your credentials.
Personally, I would not recommend ever entering your credentials into anything other than the official app or website for a service, to protect yourself from phishing. That goes even for an open source project, unless you have the technical skills to confirm that they are not stealing the info. There are strategies to hide malicious functionality even in open source projects.
In fact, just a few days ago it became known that a popular open source program used by the linux operating system has had malicious code enabling a backdoor slowly and carefully hidden inside it over years. It was found by pure luck by a developer shortly after it was completed, averting what could have been a major security crisis. (You can read more here:
Everything I know about the XZ backdoor)
One key part of that process was that the pre-built release available on github contained additional malicious code not present in the actual repository, which is what other people would check for malicious code, hiding it very effectively.
That strategy would in theory also be possible with a project like the "depot downloader", by for example adding something that sends your steam credentials to somewhere else and potentially overtakes your account to only the pre-built release.
Of course that would be extremely unlikely here, it just demonstrates the point of being careful with who you give your account credentials for a service, even with open source projects.
