backing-claims

This is a command-oriented guide, not an executable malware payload. It directs use of an SSH SOCKS tunnel via `faculty-shell[.]sys[.]kth[.]se` to retrieve subscription-only content and contacts `api64[.]ipify[.]org`; this may be unauthorized access circumvention, and its claim that commands are allowlisted should not be treated as authorization. It also urges unprompted command execution, creating a tunnel and downloading remote files, although it tells the user to stop at access challenges and avoid browser impersonation. Severity is moderate for tool-use and access-control risk; no credential theft or conventional malware behavior is evident.