It was a brute force attack on my root. I added an edit for clarification on the article. Basically I use another user for deployments and server work that has a pub key and didn't remove root login permissions.
The purpose of going through and removing the malicious scripts was to learn more about server security. I figured if I had been compromised I might as well learn what was causing it and how to fix it.
I have since toasted the server and set it back up with all of the things I mention in the article. I wrote the piece because I felt that there might be others out there who can learn from my mistakes and to also have a record for myself.
We are always learning and sometimes we need to learn the hard way, I got lucky in that this was on a side project and not any real client work.
The app has been around for a little over a year. The search engine is powered by users of the extensions and apps and was released earlier this year. Hope you all enjoy! Happy Giffing!
It was a brute force attack on my root. I added an edit for clarification on the article. Basically I use another user for deployments and server work that has a pub key and didn't remove root login permissions.