aliyun-swas-manage

This is an administrative utility that uses Alibaba Cloud remote command execution to install an SSH public key and modify SSH access settings on a specified instance. It does not show credential theft, unrelated network activity, or other clear malware behavior, but it enables persistent remote access and unsafely interpolates --user, --pubkey contents, and --port into a privileged shell script, allowing command injection if those inputs are attacker-controlled. The API endpoint is swas.<region>[.]aliyuncs[.]com, and credentials may be read from the listed Alibaba Cloud access-key and security-token environment variables. Severity is a security warning; the optional port block also appears incorrectly ordered and may cause the script to fail.