Sneaky? That's not sneaky at all. The presence of eval is a great big flashing sign saying "Backdoor here!". Why on earth does the copyright file have code in it? Sneaky is the infamous sys_wait4() backdoor in the Linux source, or using open($filename) in perl, or letting someone pass in a debugging filename that you treat as a relative path without realpath().

I've seen remote execution backdoors like this in a compromised Joomla site before (at least w/r/t the code snippet that actually does the execution), so I would not be in the least surprised if someone was clever enough to use the copyright file as a place to sneak it in.

I saw one attacker drop the same backdoor php file in a dozen different locations, in hopes that the site owner would just remove the one in particular that was showing up in their logs and none of the others.

Perhaps I can't read, but it seems the article is really lacking with a source for where this was found.

It was found in the wild.