openharmony-download

The fragment appears to be a source-download/setup script rather than clear malware. However, it presents a meaningful supply-chain security risk because it downloads and executes repo tooling without integrity verification, installs an unpinned package from a non-default mirror, disables repo verification, and executes content obtained through the manifest and Git LFS. Review MANIFEST_URL, BRANCH, the remote repo-py3 file, verify_download.sh, and the referenced repositories before use. The shown code contains no direct evidence of data theft or destructive behavior beyond project-local .repo deletion.