openclaw-upgrade

No direct, explicit malicious payload (e.g., exfiltration/backdoor/reverse shell) is evident in this script fragment. The main security concerns are non-malicious but high-impact: it executes remote code via npm/pnpm during upgrades and automated repair, can destructively delete local dependency artifacts and then install/build an additional package ('long') triggered by log matching, and it copies potentially sensitive credentials/sessions into a persistent backup directory without enforcing restrictive permissions. Treat this as a legitimate upgrade helper with moderate supply-chain and sensitive-data exposure risk; validate install/repair paths, pin/verify package versions/hashes, and harden backup permissions.