amrouter

No direct malicious payload indicators (e.g., backdoor logic, exfiltration to remote services, reverse shells) are evident in this Bash script. However, the script performs high-impact supply-chain operations: it clones a remote repository and runs npm install/build without pinning or integrity verification, then starts the resulting backend code locally. Additionally, the generated agent templates include an insecure token-like default API key when AMROUTER_KEY is not set, and sed backups may leave sensitive values on disk. Overall, treat this as a generally functional installer with significant supply-chain review and hardening needs rather than as confirmed malware.