PkgRadar

Composer · packagist.org

billz/raspap-webgui

Php Base64 Eval Chain: base64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload.

Why PkgRadar flagged 3.5.4

SeveritySignalEvidence
highPhp Base64 Eval Chainbase64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload. · RaspAP-raspap-webgui-3e37dcc/includes/functions.php
highPhp Shell With Decodeexec / system / shell_exec combined with base64/hex decode. · RaspAP-raspap-webgui-3e37dcc/includes/functions.php
mediumRemote Payloadmatched "wget " · RaspAP-raspap-webgui-3e37dcc/ajax/system/sys_chk_update.php
mediumRemote Payloadmatched "wget " · RaspAP-raspap-webgui-3e37dcc/includes/functions.php
mediumRemote Payloadmatched "curl " · RaspAP-raspap-webgui-3e37dcc/includes/internetRoute.php
mediumRemote Payloadmatched "cUrl " · RaspAP-raspap-webgui-3e37dcc/includes/restapi.php

Scanned versions

VersionVerdictScoreScanned (UTC)
3.5.4High risk612026-05-30

Block this in CI

PkgRadar gates billz/raspap-webgui (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem composer billz/[email protected]