firebase-cli

No explicit malicious payload (e.g., exfiltration/backdoor/persistence) is visible in the provided fragment. However, the script contains a major supply-chain risk: it performs direct remote execution via a curl-to-bash installer from https://firebase.tools, and it also uses global npm installation which may trigger lifecycle scripts. Given that the script is designed to operate with CI secrets/service-account credentials, compromise of the installer or installed package would have elevated impact. Use integrity verification/pinning for the standalone installer and ensure trusted sources for npm package installation.