xiao-rf-remote-firebase

The code appears to be a legitimate Firebase/ESP32 project provisioning utility rather than malware. The principal security issue is command injection through the unvalidated PROJECT argument in the execSync deployment command. It also handles and persists Wi-Fi and device credentials in generated files, creating a credential-disclosure risk if the output is exposed. PROJECT should be validated against an expected Firebase project-ID pattern or passed without shell interpolation. The code should also avoid storing secrets in source-controlled output and should use documented firebase-tools APIs where possible.