The detail that stands out to me is the reverse tunnel with -R *:0:localhost:22: removing the extension leaves the door in place, and most cleanup habits stop at uninstall. The grep on authorized_keys for svc-telemetry is the fastest triage step here. One thing worth stressing: the beacon collected names of environment variables matching KEY, TOKEN, SECRET and friends, so anyone who had 2.1.313 installed should treat those credentials as compromised and rotate them, not just clean the persistence.
Damiano Bianda
Full-stack developer: Nuxt, Vue, TypeScript, Python. Based in Ticino.
The detail that stands out to me is the reverse tunnel with -R *:0:localhost:22: removing the extension leaves the door in place, and most cleanup habits stop at uninstall. The grep on authorized_keys for svc-telemetry is the fastest triage step here. One thing worth stressing: the beacon collected names of environment variables matching KEY, TOKEN, SECRET and friends, so anyone who had 2.1.313 installed should treat those credentials as compromised and rotate them, not just clean the persistence.