The short answer is if the code was added by someone you don't know, then it's malicious, and it doesn't really matter what it does: if the code was added by someone you don't know, then it's malicious, doesn't really matter what it does.
Your server has been compromised and you need to perform a full clean up.
As for how it got added, there is no way for us to know without a full investigation of your server.