The "payload" was devious in that it basically said: if $ssh_key && $payload.sig && $host.sig Can't (easily) be replayed with a network capture against a diffe

The "payload" was devious in that it basically said: if $ssh_key && $payload.sig && $host.sig Can't (easily) be replayed with a network capture against a different host or with a different payload, and can't be triggered without a specific key. Truly laser-like in focus. My personal theory for "next step" would be: if uncompressing.contains( "linux" || "curl" ) => $extra.payload() With such a skilled attack, and the potential to _deeply_ reach arbitrary public systems, imagine the chaos of "ssh github.com && pwn( curl, gzip, git, node, ... )" ...each stealthier than the last. Most SHA-sums are against the archive, not the individual file contents. An untrustable archiver or network transfer tool (especially in combination!) is terrifying...