[slow_typist]

Maybe I don’t understand the scenario fully, but under your assumption there is no need to inject the malicious webshell later.