@RusstopiaLabs@masto.nixnet.xyz seems the payload first tries to make sure the commands it executes don't end up in any command history, and then adds its own key to authorized_keys but deduplicated in case it was already there