vm-security

This fragment implements SSH login notifications and sends usernames, remote addresses, hostname, and timestamps to the configured webhook; no endpoint is visible here. It also writes the webhook value into a shell file that is later sourced, creating a potentially serious command-execution risk if that value can contain untrusted shell syntax. Severity is conditional on the unseen handling of WEBHOOK; no other clear malicious behavior is evident.