Dissecting the Malware Injected Into My Own Ghost Blog (opens in new tab)

tl;dr: I had not looked at my blog in months and found a malicious script injected into every post through the Ghost Admin API. What it does, and how I removed it.