instabox-move-repo

This script provisions runtimes, installs project dependencies, and optionally runs builds; it also executes downloaded runtime installers and project-controlled dependency/build code. A malicious `.nvmrc` or `.node-version` can inject shell commands through the evaluated `nvm install` command, and crafted requirement filenames may affect another evaluated command. This is a security warning when run on untrusted repositories; no specific credential theft or exfiltration behavior is present.