Why both the pipe into sh and eval? The latter could handle all everything.

Couple more thoughts and unsolicited feedback from a quick eyeball:

- Use https://

- Wrap everything in a shell function to ensure that partial content is not executed.

- Wrap variable substitutions with "${OUTPUT_DIR}" to prevent arg splitting if they contain whitespace. Line 124, `rm -rf $OUT_DIR_INSTALL` is pretty scary if invoked with whitespace in OUT_DIR.

- Download nodejs tarball to temp directory and then extract them to prevent partial extraction